So, you've got your data capture.
You're now wandering offsite, yeah?
You're now heading back to base?
Is that what happens?
Yeah, we take the data that we acquired,
and then we take it back to our forensic lab and where we
hook it up to all kinds of fancy machines,
and we start tearing that data apart, sometimes down to the bit level,
if needed.
But we tear through the data, we start looking through the logs,
until our eyes are ready to fall out of our heads,
looking for all the evidence of we can,
mainly for when that breach first happened,
and we might see some preliminary activity.
We're going to look at what they did to contain it,
if they have contained it, or what needs to be contained.
We're going to analyze any of the malware.
We're going to check for any other backdoors that may have been
installed because attackers love to get it on there,
and then stick a little backdoor somewhere so they can come back in later.
And so we figure out all that stuff in the lab.
We're in constant contact with the merchant almost real time.
When we find something,
we let the merchant know so that they can be proactive
in containing the breach as well.
And we're still within this five-day window at the moment, yeah?
Correct.
Wow.
So do you pull a lot of like late night shifts or ---?
Yeah, we've worked around the clock many times.
Because that's quite interesting, the degree of urgency to this.
And then preliminary reports,
that goes to the card brands --- It goes to the card brands and merchant.
--- and law enforcement?
Do you engage directly with law enforcement?
From time to time.
We usually advise the merchant to contact law enforcement either locally,
or the FBI has a cybercrimes website where they can go and report it,
which is often good.
Because a lot of times,
these attacks are international trends or even global trends,
and the FBI, even if they don't come in and investigate your case,
they can track it as part of a bigger attack.
Yeah.
We have the same in Europe.
You report because this is organized crime.
This is not, anymore, typically some person in their bedroom.
This is correct.
This is typically criminal gangs.
Yeah, especially with the bigger attacks.
These are very well-organized attacks by people that know what they're doing.