Incident Types: The types of cybersecurity incidents that have occurred include Breach.

Detection and Response: The company detects and responds to cybersecurity incidents through an incident response plan activated with yes (honeypot deployment and monitoring), and law enforcement notified with yes (intelligence shared with law enforcement), and containment measures with isolated honeypot environment, monitoring of threat actor activity, and communication strategy with public statement denying breach of real systems, disclosure of honeypot operation, and network segmentation with isolated honeypot environment, and enhanced monitoring with yes (telemetry collection on attacker tactics and infrastructure)..

Common Attack Types: The most common types of attacks the company has faced is Breach.

Identification of Attack Vectors: The company identifies the attack vectors used in incidents through Publicly exposed systems.

Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Internal Chats, Client Lists, Threat Intelligence Reports, Employee Information, Api Keys, Access Tokens, , Employee Data, Internal Communications, Threat Intelligence Reports, Client Information and .

Incident Response Plan: The company's incident response plan is described as Yes (honeypot deployment and monitoring).

Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by isolated honeypot environment and monitoring of threat actor activity.

Key Lessons Learned: The key lessons learned from past incidents are Effectiveness of honeypots in monitoring and gathering intelligence on threat actors; importance of OPSEC in threat actor operations; challenges in attributing attacks due to overlapping threat actor groups.

Implemented Recommendations: The company has implemented the following recommendations to improve cybersecurity: Organizations should consider deploying honeypots for threat intelligence gathering; enhance monitoring of publicly exposed systems; collaborate with law enforcement for threat actor attribution and disruption..

Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: Hackread.com, and Source: ShinyHunters Telegram post, and Source: BleepingComputer, and Source: Resecurity Report, and Source: Telegram (Scattered Lapsus$ Hunters).

Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Public statement denying breach of real systems and disclosure of honeypot operation.

Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: was Resecurity has publicly denied the breach of real systems and clarified the honeypot operation..

Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as Yes (telemetry collection on attacker tactics and infrastructure).

Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Continued monitoring of threat actor infrastructure; sharing intelligence with law enforcement; potential legal action via subpoena..

Last Attacking Group: The attacking group in the last incident were an ShinyHunters and Scattered Lapsus$ Hunters (SLH).

Most Recent Incident Detected: The most recent incident detected was on 2025-11-21.

Most Significant Data Compromised: The most significant data compromised in an incident were Internal chats, client lists, threat intelligence reports, employee information (names, email addresses, authentication tokens), API keys, access tokens, Fake data (synthetic datasets, including employee data, internal communications, threat intelligence reports and and client information).

Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident were Isolated honeypot environment and monitoring of threat actor activity.

Most Sensitive Data Compromised: The most sensitive data compromised in a breach were Fake data (synthetic datasets, including employee data, internal communications, threat intelligence reports, and client information), Internal chats, client lists, threat intelligence reports, employee information (names, email addresses, authentication tokens), API keys and access tokens.

Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 218.0K.

Most Significant Lesson Learned: The most significant lesson learned from past incidents was Effectiveness of honeypots in monitoring and gathering intelligence on threat actors; importance of OPSEC in threat actor operations; challenges in attributing attacks due to overlapping threat actor groups.

Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Organizations should consider deploying honeypots for threat intelligence gathering; enhance monitoring of publicly exposed systems; collaborate with law enforcement for threat actor attribution and disruption..

Most Recent Source: The most recent source of information about an incident are BleepingComputer, ShinyHunters Telegram post, Hackread.com, Telegram (Scattered Lapsus$ Hunters) and Resecurity Report.

Current Status of Most Recent Investigation: The current status of the most recent investigation is Unverified.

Most Recent Stakeholder Advisory: The most recent stakeholder advisory issued was Resecurity has publicly denied the breach of real systems and clarified the honeypot operation., .

Most Recent Entry Point: The most recent entry point used by an initial access broker was an Publicly exposed systems.

Most Recent Reconnaissance Period: The most recent reconnaissance period for an incident was November 21, 2025 - December 2025.