r/cyberinvestigations
Some data breaches are now being investigated months after the actual intrusion
- upvotes
- 3
- comments
- 0
Post
Highlighted: the lines this signal was extracted from
Apollo Global Management disclosed that attackers obtained unauthorized access to certain cloud platforms between July 6 and July 10. The company is now investigating whether personal information including Social Security numbers, addresses, birth dates, and contact information was accessed. The interesting forensic problem is the delay. By the time a company publicly confirms a breach, the systems involved may have changed substantially, credentials may have been rotated, and the attacker may have disappeared. That makes preserved cloud logs extremely important. Investigators aren't simply trying to prove that someone accessed an account. They need to reconstruct what the account could see during a specific period and determine which data was actually accessed.