Investigating Data Extortion Involving Trusted Vendor Access

In late 2025, Sygnia investigated a data extortion incident involving a large enterprise that had received extortion emails containing authentic samples from a sensitive business database. The affected logistics platform was operated by a third-party vendor with privileged access. When Sygnia investigated, it found no signs of an outside break-in to the client’s systems. Instead, investigators identified data handling through legitimate administrative access and systems managed by the vendor.

Any organization that lets vendors access sensitive systems faces this risk. In research published in 2026, third parties were involved in almost half (48%) of data breaches, up from 30% the year before. This shows that risk can emerge when data is exported through approved channels, but little evidence exists of what happens once it reaches the vendor’s environment.

Key findings

• Legitimate administrative access, when misused, can cause as much business impact as a complex security breach.
• Vendor-operated environments must be treated as part of the organization’s effective attack surface.
• Traditional incident response methods that rely on indicators of compromise may not be enough to handle cases where trusted access is misused.
• Attribution is valuable but not always required to reach actionable risk decisions.

The first sign of data theft was an extortion email

Database samples confirmed the extortion demand included real organizational data, but they did not show how the sender obtained it.

Sygnia started the investigation by checking the client’s environment for signs of an external breach. However, investigators did not find any evidence of malware, exploitation, lateral movement, persistence, or any proof that an outside actor was in the client’s network. The intrusion scenarios they reviewed could not explain the data loss.

The vendor already had privileged access to the production environment to run and maintain the logistics platform. Investigators reviewed administrative activity performed through that access and checked whether the administrative actions matched the vendor’s approved work. This allowed them to investigate the data loss without assuming an outside attacker had first broken into the client’s systems.

Reconstructing how the data left the environment

Sygnia used contextual forensic analysis to reconstruct the data handling sequence. Comparing historical database backups with samples supplied by the extortion actor narrowed the suspected extraction window and provided a timeframe to examine privileged administrative activity.

That forensic activity identified a uniquely named database backup created manually outside the normal approved operational workflows. The backup was compressed and the subsequent archive handling was carried out via legitimate admin tooling. Attempts were made to move the archive via FTP infrastructure. Temporary transfer infrastructure was then established within the vendor’s environment.

Subsequent cleanup and efforts to reduce visibility limited the available forensic evidence. The findings indicate manual data extraction and transfer through vendor-controlled infrastructure, with no exploit chain or malicious tools identified for those operations. The complete path by which the data reached the extortion actor remains undetermined.

Where the evidence became harder to follow

Forensic visibility declined after the data entered the vendor-controlled environment. Reconstructing the data handling relied on records subject to the vendor’s logging, retention, and evidence-preservation practices.

Vendor-side forensic analysis identified additional anomalies consistent with the reconstructed data handling timeline. These included directories created for manual file movement, missing or deleted logs and artifacts, and post-incident access to historical logs. While these findings warranted scrutiny, they did not conclusively establish persistent activity by an external actor within the vendor environment.

The timing of the extortion demand introduced another constraint. The first extortion email arrived exactly 90 days after the identified data extraction date, coinciding with the client’s log-retention window. By that point, relevant retention periods had expired, leaving investigators without some historical records needed for retrospective analysis. The investigation could not determine whether the timing was intentional.

The investigation confirmed the vendor’s involvement in the data-handling activities, but the identity of the extortion actor remained unknown. This uncertainty did not prevent investigators from identifying weaknesses in forensic visibility and evidence preservation across both environments.

Why legitimate activity required closer scrutiny

Intrusion-focused detection programs look for evidence such as malware execution, exploitation, malicious network traffic and known threat-actor infrastructure. In this case, much of the observed activity resembled routine administration, including:

• Valid credentials and MFA-authenticated sessions.
• Standard administrative tooling.
• Approved access paths.
• Vendor-operated systems.

These characteristics made the activity difficult to distinguish from authorized operational work. While authentication records confirmed system access, they did not indicate whether subsequent handling of sensitive data was authorized.

Assessing this activity required technical forensics and operational context. Investigators compared database operations and file movements to approved workflows and vendor responsibilities. The legitimacy of a tool was less important than whether its use was expected and aligned with surrounding administrative activity.

Relying solely on traditional indicators of compromise (IOCs) would have been insufficient. The forensic assessment needed to determine whether anomalous activity reflected misuse of existing privileges.

What organizations should monitor when vendors have privileged access

Oversight of privileged vendor access should address administrative operations on sensitive data and evidence retention in both environments. This case highlights key monitoring and governance measures organizations should take.

Monitoring

• Monitor manual database exports and backup creation outside approved workflows. Include unusually named backup files in forensic reviews, and assess them with related account activity and operations.
• Alert on administrative compression and archive handling involving sensitive databases. Confirm these operations align with the vendor’s authorized activities.
• Detect ad hoc or temporary file-transfer infrastructure. Monitor FTP service activation and vendor-initiated file transfers to temporary storage.
• Investigate actions that reduce visibility. Unexpected log deletion, retention changes, and cleanup of transfer artifacts can hinder forensic analysis. Review these actions with related data handling activity.

Monitor privileged operational workflows in addition to endpoints, allowing database and transfer activity to be reviewed with the corresponding administrative sessions.

Access and evidence

• Review vendor privileges against operational responsibilities. Ensure production permissions and access to sensitive data remain appropriate for current tasks.
• Implement privileged access governance and session recording as appropriate. Retain records that identify administrative actions performed through vendor accounts.
• Extend logging and retention requirements to vendor-operated environments. Specify which database, administrative, and file-transfer activities must be recorded. Consider delayed discovery when setting retention periods.
• Define evidence preservation and access requirements in advance. Specify who will secure vendor-held logs and artifacts, how routine deletion will be suspended, and how evidence will be provided to responders.

These requirements should give responders a clear process for obtaining and preserving evidence beyond the client’s systems, even if the identity of the extortion actor remains unknown.

Conclusion

Supply-chain security extends to the access vendors use every day to operate critical systems. Those privileges can be used to move sensitive data beyond an organization’s control, while differences in logging and retention can limit its ability to reconstruct what happened. In this case, the extortion demand arrived after relevant records had expired.

Incident readiness therefore needs to include the ability to examine activity performed through authorized access, including within vendor-operated environments. Vendor governance and evidence preservation are part of that readiness, because an organization’s ability to investigate data loss depends partly on arrangements made long before the incident becomes visible.