Data Breach Investigation and Impact Analysis

Customer data of 5 million users found on dark web forum. Students will reconstruct breach timelines and assess impact on affected customers.

# Aplly.xyz Case Study Submission

## Title
Data Breach Investigation and Impact Analysis

## Type
Investigative Forensics

## Difficulty
Intermediate

## Estimated Time
60 minutes

## Overview
Customer data of 5 million users found on dark web forum. Students will reconstruct breach timelines and assess impact on affected customers.

## Case Details

Function Focus: Investigative Forensics — manual reasoning, decomposition, and critical judgment (no spreadsheet or AI tool permitted in Phase 1)

Scenario:
You are the analyst at a fictional consultancy ("Praxis Advisors") tasked with answering: Data Breach Investigation and Impact Analysis. You have a clean, synthetic dataset described below. You must produce a defensible answer using structured reasoning — no tool-assisted shortcut on the first pass.

Dataset Structure:
- event_id
- timestamp
- breach_type
- source_ip
- target_system
- data_category
- records_affected
- data_sensitivity
- exfiltration_method
- vulnerability_exploited
- detection_delay_hours
- containment_time_hours
- patched
- affected_users
- reported_to_authority

Tasks:
1. Read the dataset and reconstruct the sequence of events/evidence. State explicitly which records are confirmed facts vs. inference.
2. Identify the key anomaly or cluster that points to a primary suspect, source, or mechanism. Explain your filtering logic by hand.
3. Build a timeline or network diagram on paper linking the relevant records, showing how the evidence chain connects.
4. Weigh at least two alternative explanations (hypotheses) for the finding and use the data to eliminate one. Be explicit about what data would change your conclusion.
5. Only after completing the above manually, verify your filtering/timeline with a spreadsheet or tool and note any discrepancy.

Expected Output:
A one-page investigation memo: findings, evidence chain/timeline, eliminated hypotheses, final conclusion with confidence level.

Evaluation Criteria:
Quality of evidence-chain logic, explicit fact-vs-inference separation, correctness of hypothesis elimination, defensibility of the conclusion.

## Data Sources

| event_id | timestamp | breach_type | source_ip | target_system | data_category | records_affected | data_sensitivity | exfiltration_method | vulnerability_exploited | detection_delay_hours | containment_time_hours | patched | affected_users | reported_to_authority |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Dropped | False | 25000 | N/A | Inconclusive | Positive | Chennai | Closed | EXF-0130-001 | 2026-04-15 | Bangalore | Inconclusive | PAT-0130-001 | Filed | Confirmed |
| Filed | Filed | Chennai | Filed | 3.5 | Pending | REC-0130-002 | Inconclusive | Delhi | VUL-0130-002 | DET-0130-002 | Kolkata | Pending | 2026-03-15 | 2026-04-15 |
| EVE-0130-003 | TIM-0130-003 | Low | Chennai | Positive | High | 0 | 1 | Chennai | Urban | Active | 2026-03-15 | Confirmed | AFF-0130-003 | Arrested |
| At large | TIM-0130-004 | BRE-0130-004 | Inactive | Delhi | 12.5 | Medium | 100000 | 0 | 42 | Inactive | Chennai | 85 | 3.5 | Dropped |
| 0 | Medium | Rural | SOU-0130-005 | TAR-0130-005 | Confirmed | Pending | Pending | Resolved | Yes | Delhi | CON-0130-005 | Active | Medium | 85 |
| 2026-03-15 | 12.5 | Rural | Chennai | Under investigation | Bangalore | Not detected | DAT-0130-006 | 100000 | False | Unresolved | Dropped | Active | Delhi | 0 |
| 2026-03-15 | Low | Not detected | SOU-0130-007 | 25000 | 2026-04-01 | Pending | Negative | High | False | 2026-04-01 | Urban | 1 | 25000 | Mumbai |
| At large | Medium | BRE-0130-008 | SOU-0130-008 | Secure | Urban | 100000 | At large | Arrested | Resolved | N/A | Inconclusive | N/A | 25000 | Inconclusive |
| EVE-0130-009 | TIM-0130-009 | Inactive | Mumbai | Medium | Under investigation | 1 | Closed | Under investigation | 2026-03-15 | Rural | Mumbai | Mumbai | Filed | Kolkata |
| EVE-0130-010 | 1 | Yes | Medium | Unresolved | DAT-0130-010 | Not detected | DAT-0130-010 | Positive | Resolved | 2026-04-01 | 2026-04-01 | Active | Medium | 12.5 |


Full dataset: https://github.com/arora200/aplly_case_db/datasets/078-forensic-data-breach (synthetic, 15 records)

## Solution Frameworks
Evidence chain reconstruction, hypothesis testing (deductive elimination), timeline analysis, pattern & anomaly detection, source corroboration

## Solver Guidance & Tutorials
_Solver guidance added by the pipeline (tutorial links) — see `solver_guidance` field._

## What You'll Learn
- Rebuild a chain of events from partial records
- Separate confirmed fact from inference
- Eliminate hypotheses with data

## Tags
Data Breach, Cybercrime, Dark Web, Incident Response

## Registration Links
Register as Solver / Register as Evaluator