CONFIDENTIAL CONTACT
Appointing a crisis adviser? Clarify authority first
Start with the provider, engagement scope and concerns. Do not send leaked files, credentials or complete customer lists in an initial inquiry.
Systems are down, customers are asking questions and an attacker has imposed a deadline. A promise to handle everything can sound irresistible. Yet the ability to communicate does not confer authority to decide every issue for the company.
Even under pressure, use a short authority record: who can access information, speak externally, make recommendations and approve action? Expert assistance should help the business retain control of its decisions.
Establish the facts needed for the decision, then identify the missing records.
A Reuters report dated 10 October and republished on 12 October 2026 described the arrest of Canadian ransomware negotiator Edward Dubrovsky on extortion-related charges. It noted partially sealed records and discrepancies in name spelling. Charges are not a conviction.
We do not infer undisclosed conduct or company liability. Our analysis concerns procuring crisis services and retaining company authority, not instructions for ransom payments or dealings with criminals.
Confirm the contracting entity, actual personnel, referral route, subcontractors and fee basis. Even with a trusted referral, establish who the client is, who receives reports and which decisions remain with management.
Professional titles, publicity and social profiles are not complete verification. Use independent channels to confirm roles and seek conflict disclosures. Nationality or a person’s name is not a basis for assuming dishonesty.
A promise to delete data is different from independently verified deletion. Recovery of access does not establish that copies were never made. Assess restoration, exposure, legal duties and communications as separate issues.
Any proposed payment raises legal, sanctions, insurance and other concerns for authorised decision-makers and appropriate specialists. This article neither recommends nor arranges payment, and does not treat a criminal’s assurance as a guarantee.
Keep engagement terms, access approvals, work tickets, dated advice, communications and fee records. A later review may need to understand not only the attack, but also the information on which the company acted.
If concerns arise, coordinate preservation and necessary access controls with technical responders and counsel. Do not erase working records while attempting to remove risk, or disrupt recovery without a handover plan. The correct sequence depends on the system and applicable duties.
Within a lawful agreed scope, we can review public provider background, engagement and referral relationships, disclosures, authority records and the response timeline. We identify questions requiring specialist legal or technical assessment.
This does not replace emergency incident response, police or legal advice. We do not promise decryption or ransom recovery. Our contribution is risk research and evidence organisation alongside the client’s appointed specialists.
Useful emergency support should leave the company better informed, not dependent on one person’s assurances. Clear authority, fees and records allow professionals to work together.
Avoid concentrating the evidence, external communications and final approval in one unchecked role. Delegating specialist work need not mean losing the ability to review it.
Start with the provider, engagement scope and concerns. Do not send leaked files, credentials or complete customer lists in an initial inquiry.
