Containing a ransomware crisis and restoring operations for a global bank in 72 hours

When a destructive ransomware attack encrypted critical payment-processing infrastructure, Law & Forensics contained the breach, preserved evidence for regulators, and returned the bank to full operation — all without a single dollar of ransom paid.

---

The situation#

A top-10 U.S. commercial bank with operations across 40 countries discovered ransomware spreading through its core transaction-processing environment on a Friday evening. Within three hours of the initial alarm, 1,400 servers were encrypted, ACH and wire-transfer processing was suspended, and customer-facing digital banking channels were degraded. The threat actor issued a demand and a 48-hour deadline.

The stakes extended well beyond the ransom figure. FFIEC incident-reporting requirements, state breach-notification statutes in 12 jurisdictions, and the bank's own regulators demanded timely, accurate disclosure. Evidence necessary for potential criminal prosecution and future civil litigation had to be preserved without disrupting recovery. The bank's internal security team, exhausted and overwhelmed, needed experienced forensic leadership immediately, working alongside its outside counsel.

Our approach#

Law & Forensics mobilized a multidisciplinary response team — senior incident responders, digital forensics examiners, and regulatory compliance specialists — within four hours of engagement, engaged through the bank's counsel. The team operated four parallel workstreams simultaneously:

Containment and threat eradication. Network segmentation was enforced within the first six hours to prevent lateral spread to unaffected data centers. The initial access vector — a misconfigured SSL-VPN appliance running an unpatched firmware version — was identified, isolated, and remediated. Threat-actor tooling, persistence mechanisms, and staging infrastructure were catalogued and removed from every affected host.

Forensic preservation. Court-admissible forensic images were captured from all 1,400 affected servers using a triage-and-image protocol that ran concurrently with remediation, ensuring that recovery activities did not destroy the evidentiary record. Chain-of-custody documentation was maintained throughout.

Regulatory and legal coordination. Law & Forensics' team worked directly with the bank's general counsel and outside regulatory counsel to draft and sequence notifications to the OCC, relevant state banking regulators, and affected consumers — meeting all statutory windows without requiring extensions.

Recovery validation. Before any system was returned to production, Law & Forensics validated each restored server against a clean baseline and conducted adversarial testing to confirm that no threat-actor persistence remained. A "clean room" environment was stood up within 24 hours to restore the most critical payment functions first.

The impact#

Full ACH and wire-transfer processing was restored within 72 hours. No ransom was paid. All regulatory notifications were delivered within applicable deadlines, avoiding potential enforcement action. A comprehensive criminal referral package — including network logs, malware samples, and threat-actor attribution indicators — was delivered to federal law enforcement. The bank subsequently retained Law & Forensics to redesign its third-party VPN access controls and incident-response program.