“The extent and volume of information that they were able to obtain in these subpoenas goes beyond the capabilities of an individual,” Sam Rubin, a vice president of the Crypsis Group cybersecurity firm, says in Lake’s report. “It’s set up in a systematic manner, to be shared by what appears to be a team.”

The scale of the operation, as well as the targets, suggest this was a state operation. “The extent and volume of information that they were able to obtain in these subpoenas goes beyond the capabilities of an individual,” said Sam Rubin, a vice president of...

“Rooney and the Crypsis team are called in after a cyber incident. It often starts with a call from an attorney who has determined that an investigation is required. Crypsis runs proprietary programs and deploys their team of expert consultants to see how a hacker gained access to the network and where the IP address originated. They also determine how long the hacker retained access to the system and what information they had access to. That report is passed back to the attorney to work on remediation of the issues to stop a future attack.”

“Bret Padres, who investigated PR Newswire’s breaches while at Stroz Friedberg and was later hired by
the government in connection with the case after he became CEO of the Crypsis Group, took the stand
to provide further expert testimony. He said his team installed a “sniffer” on PR Newswire’s systems and found that its login page had been tampered with to send user credentials to a computer in Ukraine.”

“If there had been two-factor authentication in place, many of these attacks would not have been possible,” says Sam Rubin, vice president of Crypsis Group, a security advisory firm hired by Broidy. “Securing the human, as they say, is always going to be the weakest link.”

Bret Padres, a former Air Force computer-crime investigator who is now the C.E.O. of the Crypsis Group, a cyberforensics firm, told me about some work he had done for a defense contractor whose server had been breached. He examined malicious code that the hackers had left behind, and found that it contained the I.P. address of the hackers’ hop point, along with their sign-in credentials. Soon after Padres shared this information with the client, a member of the company’s I.T. team hacked into the hop point and grabbed all the data. How did the contractor’s lawyers justify the raid? “They weren’t asked,” Padres said.

 Cyber security firm hires nationally-known digital forensics expert to run new L.A. office; also expands operations in Chicago

As Bret Padres, a former intel official and CEO of The Crypsis Group tells Axios, “a just as plausible explanation is that this is a coding error” that makes it look like a wiper and not a simple ransomware hack.

The ransom requested for access to an infected computer is $300 in bitcoin, and “doesn’t seem consistent with state-sponsored attackers,” Bret Padres, a former intel official and CEO of The Crypsis Group, tells Axios, although he would not rule out a state-sponsored attack.