Selected engagements across incident response, security testing, compliance and investigation, from manufacturing and healthcare to financial services and individual clients.
Client confidentiality: all identifying details have been anonymised in line with our privacy policy and data protection law. Several cases are subject to non-disclosure agreements or ongoing proceedings. Outcomes are genuine; only details that could identify a client have been changed.
Fraud investigation outcomes depend on factors outside our control, including cooperation from financial institutions, jurisdiction, timing and whether funds remain traceable. Past results do not guarantee future outcomes, and recovery cannot be assured in any new engagement.
Ransomware responseManufacturing
Critical infrastructure ransomware attack
Challenge
A manufacturer with 500+ employees found its entire production network encrypted by LockBit ransomware. Operations stopped, with losses of €2.3M a day, and the attackers demanded €800,000 in Bitcoin.
Our response
Our incident response team was deployed within 90 minutes. We isolated affected systems, identified the entry point (compromised VPN credentials), started forensic analysis and located viable backups from 36 hours earlier.
Outcome
Systems fully restored within 72 hours with no ransom paid. Multi-factor authentication, network segmentation and 24/7 monitoring implemented. No data exfiltration confirmed.
Penetration testingFinancial services
Banking application security assessment
Challenge
A regional bank launching a new mobile banking platform needed full security testing to meet regulatory requirements and protect customer funds.
Our response
Full-scope penetration test covering APIs, authentication, session management and encryption. We identified 23 vulnerabilities, including 4 critical issues that could have allowed unauthorised fund transfers.
Outcome
Every vulnerability fixed before launch and the platform passed its regulatory audit, avoiding potential losses estimated at over £15M.
Data breach responseHealthcare
Healthcare provider data breach containment
Challenge
A private healthcare network detected unusual database queries. Investigation showed unauthorised access to patient records over 18 months, potentially affecting 45,000 patients.
Our response
Immediate containment. Forensic analysis traced the breach to compromised third-party vendor credentials. We managed notifications to the ICO and affected patients and coordinated with law enforcement.
Outcome
Breach contained within 6 hours and the incident report satisfied regulators, with no fines imposed. Zero-trust architecture and vendor security controls implemented.
DDoS mitigationE-commerce
E-commerce platform DDoS defence
Challenge
An online retailer was hit by a sustained 340 Gbps DDoS attack in peak season. The site was down, losing around £180,000 an hour in sales.
Our response
Emergency mitigation: traffic rerouted through scrubbing centres, rate limiting applied and web application firewall rules deployed to filter attack traffic while letting customers through.
Outcome
Service restored within 45 minutes. The attack continued for 6 days with no customer impact, and permanent DDoS protection now mitigates further attacks automatically.
Insider threatTechnology
Intellectual property theft investigation
Challenge
A software company suspected a departing senior developer of taking source code and client lists to a competitor, and needed forensically sound evidence for legal action.
Our response
Covert digital forensic investigation of endpoint activity, cloud storage logs, email patterns and USB connections, with chain of custody preserved for all evidence.
Outcome
Documented 2.3 GB of proprietary data moved to personal devices. The evidence supported civil litigation resulting in a £1.2M settlement and an injunction.
Cloud securityLegal services
Law firm cloud infrastructure security
Challenge
A mid-sized law firm moving to the cloud had to protect client confidentiality and meet SRA requirements while supporting remote lawyers.
Our response
Designed and implemented a secure cloud architecture with end-to-end encryption, conditional access, data loss prevention and full audit logging, and trained staff on new procedures.
Outcome
Migration completed with zero data incidents and an SRA compliance audit passed, with a 40% gain in operational efficiency. Managed security services retained.
Security auditRetail
PCI-DSS compliance security audit
Challenge
A retail chain processing over £50M a year in card payments faced a PCI-DSS audit after a self-assessment revealed significant gaps.
Our response
Gap analysis across all 12 PCI-DSS requirements, a prioritised remediation roadmap, network segmentation, encryption upgrades, access controls, staff training and documentation.
Outcome
Full PCI-DSS Level 2 compliance in 4 months, a QSA audit passed with zero non-conformities, and card fraud losses down 78% in the first year.
Email securityProfessional services
Business email compromise prevention
Challenge
An accounting firm almost transferred £430,000 to fraudsters after its CEO's email account was compromised. The attackers had monitored communications for weeks.
Our response
Account recovery and forensic analysis, followed by advanced email threat detection, DMARC, DKIM and SPF, conditional access and out-of-band verification for payments.
Outcome
The transfer was stopped before funds left the account, 3 further compromised accounts were found, and 47 attempted attacks were blocked in the following year.
Network securityEducation
University network security overhaul
Challenge
A university with 15,000 students and staff had suffered repeated incidents, including cryptomining malware and student data exposure, on legacy infrastructure.
Our response
Network redesign with next-generation firewalls, network access control, SIEM and endpoint detection and response, and separate segments for research, administration and students.
Outcome
Security incidents down 94% in the first year, Cyber Essentials Plus certification achieved, and research data protected to government standards.
Vulnerability managementEnergy
Critical infrastructure vulnerability assessment
Challenge
An energy distributor supplying 200,000 homes needed its operational technology assessed without disrupting critical services.
Our response
A custom, non-intrusive methodology: passive network analysis, firmware review and controlled testing during maintenance windows, with every asset mapped.
Outcome
156 vulnerabilities identified, including 12 critical SCADA issues, remediated over 6 months. Ongoing vulnerability management now in place.
Investment fraudIndividual client
Cryptocurrency investment fraud investigation
Challenge
A retired professional lost £287,000 to a fraudulent cryptocurrency investment platform, with funds moved across multiple exchanges and wallets.
Our response
Blockchain forensic analysis traced the funds and identified the exchange accounts used. We coordinated with international law enforcement and supported legal action in several jurisdictions.
Outcome
£198,000 (69%) recovered through exchange freezes and legal action. The criminal investigation is ongoing, with arrests in two countries.
Wire fraudReal estate
Property transaction wire fraud
Challenge
A homebuyer sent a £520,000 deposit to fraudsters who had intercepted and altered their solicitor's emails. The money was moved rapidly between accounts.
Our response
Emergency bank recall procedures started within 2 hours. We traced the funds, supported court freezing orders and worked with Action Fraud and the receiving banks.
Outcome
£485,000 (93%) traced and recovered before withdrawal, and the purchase completed. We then helped the solicitor implement secure communication procedures.
Romance fraudIndividual client
Romance fraud investigation
Challenge
A client had sent over £165,000 across 18 months to someone they believed was a partner, using bank transfers, gift cards and cryptocurrency.
Our response
A complete evidence package: cryptocurrency transactions traced, money mule accounts identified and technical intelligence provided to the financial institutions involved.
Outcome
£72,000 recovered through bank reimbursement and frozen funds. The evidence contributed to an international investigation into an organised fraud network.
Invoice fraudConstruction
Supplier invoice manipulation
Challenge
A construction company paid £340,000 into fraudulent accounts over 4 months after criminals compromised a supplier's email and altered invoice bank details.
Our response
Email header forensics identified the compromise. We coordinated with 6 receiving banks to freeze assets and documented evidence for the insurance claim.
Outcome
£195,000 recovered from frozen accounts and £98,000 from insurance: £293,000 (86%) in total. Invoice verification procedures implemented.
Identity theftIndividual client
Identity theft resolution
Challenge
Criminals used a client's identity to open 12 credit accounts, take out a £45,000 loan and attempt to remortgage their home.
Our response
We worked with every affected lender, the credit reference agencies and law enforcement, obtained CIFAS protective registration and disputed each fraudulent account.
Outcome
All fraudulent accounts closed and removed within 3 months, the credit score restored and the mortgage fraud blocked.
Trading platform fraudIndividual client
Forex trading platform investigation
Challenge
An investor lost €410,000 to an offshore forex platform that showed fabricated profits and blocked every withdrawal.
Our response
Payment flows traced to the processors and banks involved, complaints filed with regulators in 4 countries, and chargebacks and civil action against payment processors supported.
Outcome
€245,000 recovered through processor settlements and chargebacks. The platform was shut down by regulators.
Pension fraudIndividual client
Pension liberation fraud
Challenge
A client transferred a £380,000 pension into an unregulated scheme promising early access, and also faced potential tax penalties of over £150,000.
Our response
We engaged the Pensions Ombudsman and FCA, traced funds through offshore structures and identified the trustees and advisers responsible.
Outcome
£290,000 recovered from the adviser's indemnity insurance and frozen scheme assets, and HMRC penalties reduced by 80%.
Authorised push paymentSmall business
CEO impersonation fraud
Challenge
A finance manager transferred £175,000 after urgent instructions that appeared to come from the CEO, sent from a spoofed domain referencing real internal projects.
Our response
Immediate engagement with the receiving banks, forensic analysis of the attack and a documented case for the insurance claim.
Outcome
£142,000 recovered through bank freezes and reimbursement. Email authentication, payment verification and staff training introduced.
Tech support fraudIndividual client
Remote access tech support fraud
Challenge
An elderly client gave remote access to scammers posing as Microsoft and paid £95,000 in fake fees over 3 months while their banking was monitored.
Our response
All accounts and devices secured, the computer forensically examined and evidence compiled for complaints under vulnerable customer protections.
Outcome
The full £95,000 reimbursed by the banks, the computer cleaned and ongoing monitoring put in place.
Corporate fraudImport and export
International trade fraud investigation
Challenge
An importer paid $890,000 for goods that never arrived after supplier communications were intercepted and payments redirected across 4 countries.
Our response
Cross-border investigation coordinated with INTERPOL and law enforcement in the UAE, Hong Kong and the UK, with freezing orders and civil proceedings.
Outcome
$612,000 (69%) recovered, the criminal network identified and arrests made. Secure payment verification introduced with all suppliers.
Facing a similar situation?
Every case is different. Talk to a specialist in confidence about yours.