The challenge
A national political party in Canada received an extortion communication in November 2025 from an anonymous threat actor. The actor substantiated the threat with proof of possession of sensitive files, including credit history records of 15 Members of Parliament. An initial investigation revealed that the threat actor had exploited a misconfigured web application used for party membership registration to exfiltrate applicant files.
CRA approach
Within 24 hours, legal counsel engaged CRA’s Forensic Services team to conduct an incident response investigation under privilege. Our team performed forensic analysis of the WordPress application backend, AWS hosting environment, nearly three years of Apache logs, web application firewall logs, and WordPress activity logs.
Using this evidence, we reconstructed the complete attack timeline and identified the threat actor’s methodology. We then replicated the attack techniques to determine the full scope of compromised data. The team also conducted dark web monitoring and threat intelligence research to assess whether the exfiltrated information had been publicly disclosed or traded.
The impact
Our investigation delivered a clear assessment of the root cause, exposure scope, and intrusion timeline. These findings enabled legal counsel to advise the client on notification obligations and prioritize remediation efforts.
The forensic evidence also provided counsel with a defensible account of the attack methodology and affected data, helping support regulatory inquiries and stakeholder communications.
Relationship
This engagement originated through our established relationship with Goodmans LLP, which retained CRA within 24 hours to conduct the privileged investigation. Goodmans’ confidence in our ability to manage politically sensitive cybersecurity matters, combined with our proven track record in rapid incident response, made CRA the preferred forensic partner for this high-profile engagement.
The successful outcome reinforced CRA’s ability to deliver rigorous technical analysis that directly supports legal counsel’s strategic advisory role in complex and sensitive matters.
