TheDPDPAct.com -
Official WhatsApp Channel
Stay updated with the latest DPDP Act news, compliance insights, updates, and resources.
Join Our WhatsApp Channel →How It Was Found
The first the organisation knew of the breach was a notification from law enforcement. The company's logo had appeared on a criminal leak site, and that was the whole alert. There were no reports of encrypted systems and no ransom note.
This is a case documented in the CSIS Spring 2026 Threat Matrix Report, and it is worth walking through slowly, because almost every assumption in a typical ransomware plan fails in it. We are describing only what the report states. It does not name the victim, and we have added no details of our own.
What the Investigation Found
Once responders began working backwards, the picture was longer than anyone expected. The earliest confirmed unauthorised events dated back to the summer of 2025. The attackers had held long-term access through the VPN, and suspicious activity traced to the SSL VPN segment, the part of the network that organisations tend to treat as trusted. From there they had compromised domain administrator accounts and moved between systems over RDP.
In other words, the intruders had been inside for months, with privileged credentials, and nothing visible had given them away.
CSIS draws two lessons. "Long dwell time (months) is possible when visibility is limited." And: "A leak-site posting can indicate a serious compromise even when no ransomware encryption or ransom note is present."
The Part That Hurt Investigators
When the team tried to reconstruct the beginning of the intrusion, they hit a wall. VPN appliance and domain controller logs had been kept for limited periods, so key historical records for the earliest stage were gone. The company knew it had been breached. It could not fully establish how, or exactly when, it started. That uncertainty makes every later question harder: what was taken, who is affected, and what is owed to them.
What Went Right
One thing worked. The cloud provider confirmed suspension of the abused account quickly, which CSIS says prevented further uploads and stopped the attacker from retrieving the data. That speed limited the damage, but it could only happen once someone knew there was an incident.
Why This Is Not an Isolated Story
CSIS places the case in a wider shift. It describes Hunters International claiming a move toward a data-extortion-only model under the "World Leaks" brand, and ShinyHunters as historically associated with data theft rather than ransomware. In October 2025, Mandiant reported that Cl0p had exploited a zero-day in Oracle E-Business Suite to steal data in August 2025, followed by extortion emails.
The economics may be shifting too. Coveware's July 2026 analysis put the payment rate for exfiltration-only cases at a historically low 15% in Q2 2026. Lower payment rates do not mean lower harm, though. Victims still face notification duties, legal exposure, and customer fallout.
Lessons, Turned Into Measures
Each part of the case points to a specific control.
1. Because the way in was the VPN: treat remote access as a monitored zone, not a trusted one.
Alert on logins at unusual hours or from unfamiliar locations, rarely used accounts, long sessions, and new devices. Patch edge devices fast. CSIS separately describes Akira exploiting an SSL-VPN flaw (CVE-2024-40766) during a patch delay window, and NCC Group's Q2 2026 report found corporate VPNs and edge devices were the most exploited entry points this year.
2. Because the attackers reached domain admin: watch privileged identity.
New privileged accounts, unexpected group membership changes, and sudden domain administrator use should raise alerts, however quietly they occur.
3. Because they moved over RDP: map normal lateral movement, then flag the rest.
RDP between machines that do not normally connect, especially from the VPN pool toward sensitive servers, is a strong signal.
4. Because there was no encryption alarm: watch for staging and egress.
In an extortion-only attack, exfiltration is the objective. Look for large archives appearing on file servers and unusual volumes leaving for cloud storage or unfamiliar destinations. Coveware reports lateral movement and exfiltration each appeared in 76% of the cases it analysed.
5. Because the logs ran out: keep them longer.
Retain VPN, directory, and firewall logs long enough to investigate an intrusion that began months earlier. We suggest a year as a starting point.
6. Because backups would not have helped: stop planning only for outages.
Backups restore availability, and this attack took none. Mandiant's M-Trends 2026 notes ransomware operators also target backup infrastructure and delete backup objects from cloud storage, so keep backups protected and tested, but do not mistake them for a defence against disclosure.
7. Because paying is unreliable: decide your stance early.
Coveware's July 2026 post says the advice "if you pay a ransom, your data will be deleted" proved incorrect, citing the LockBit takedown and a June 2026 SaaS-vendor case in which another group kept victims' data after a reported payment. Decide in advance, with counsel, who decides.
8. Because someone else found it first: get faster at finding it yourself.
M-Trends reports organisations spotted malicious activity themselves in 52% of 2025 investigations, up from 43%. The remaining share is found by outsiders, as here.
9. Because notification does not need encryption: rehearse it.
CERT-In's directions require reporting serious incidents, such as unauthorised access to systems or data, within six hours of awareness. When the DPDP Act's main provisions take effect around May 2027, personal data breaches will also need a Board notification, with an immediate description and a detailed report within 72 hours. Run a tabletop exercise on this scenario: a third party tells you your data is on a leak site. Can you work out what was taken, who is affected, and what you owe by when?
10. Reduce what there is to steal.
Data you no longer need and no longer retain cannot be extorted.
Where ILLUME Intelligence Can Help
ILLUME Intelligence's SOC service provides the monitoring and detection aimed at the quiet stages above: remote-access anomalies, privileged identity changes, lateral movement, and data leaving the network. Our Incident Response service helps you investigate, scope what was taken, and manage notification when an incident is found, including incidents with no encryption. A short review of your remote-access logging and log retention is a practical first step.
The Bottom Line
The most striking part of the case is how ordinary the surface looked. No outage, no note, no alarm, only a quiet intruder with privileged access and a business that could not see it. The defence is not a better backup. It is the ability to notice the unremarkable early: odd VPN sessions, a new admin, an unfamiliar RDP path, a large transfer, and enough log history to explain them.
