Case studies
Proof, not promises.
Twelve investigations, told the way they happened: the question we were asked, the tradecraft we used, the confidence we reported and what our clients did with the answer. Client names are withheld and identifying details changed. Methods, timelines and outcomes are not.
All case studies
Retail banking
212 domains, one operator
A shared tracking tag tied a sprawling investment scam to a single operator, his payment rails and the shell companies holding the proceeds.
Technology manufacturing
Attributing a product roadmap leak in nine days
A confidential roadmap surfaced on an enthusiast forum. Screenshot artifacts, posting habits and the client's own access records narrowed 340 possible sources to one.
Private equity
The shareholder who was not there
Eleven shell entities across four jurisdictions hid a beneficial owner linked to a sanctioned individual, three weeks before signing.
Government
Mapping a 1,900-account network before a national vote
Creation-date clustering, recycled images and a shared posting schedule exposed a commercial influence operation posing as local voters.
Consumer brands
From anonymous threats to a name in 36 hours
Escalating threats against a chief executive came from throwaway accounts. A reused image and a careless upload led to the person behind them.
NGO coalition, pro bono
Fake job ads, real victims
Recruitment ads in four languages shared contact details, photos and fee structures that exposed one labor trafficking recruitment network.
Freight and logistics
The breach that was not
An extortion crew claimed 4 TB of stolen files and set a 72-hour deadline. Sample analysis showed recycled data from an old third-party breach, and the demand went unpaid.
Enterprise software
Nineteen engineers who were not there
Recycled portfolios, mismatched histories and shared payout details tied nineteen remote contractors to four facilitators operating borrowed identities.
Apparel and footwear
Four tiers down
Trade records, registry filings and local-language sources traced two facilities with forced labor indicators into the fourth tier of a brand's supply chain.
Energy
Six hours to decide
Viral footage showed unrest closing in on a remote site with 140 staff. Geolocation and native-language verification showed which claims were true and which road was open.
Life sciences
The second employer
Patent filings, grant acknowledgments and conference programs showed a senior scientist held an undisclosed parallel post overlapping the client's core program.
Motor insurance
One crash, eleven claims
The same tow truck, two repair shops and a handful of phone numbers connected 46 collision claims to nine organizers. Seven flagged claims proved genuine and were paid.
How we publish
Anonymized by design. Accurate by policy.
Our clients hire us for discretion, so most of our work will never be published. The cases here were selected because they show how we work, and each one was approved for publication by the client.
Where a case involved people who were never charged or named publicly, we refer to them as Subject A, Subject B and so on. Where a detail could identify a client, a victim or a source, we change it and keep the analytical substance intact.
- Written approval from the client before anything is published
- Client names, locations and identifying details withheld or changed
- Methods, timelines, numbers and confidence levels reported as they were
- Outcomes confirmed by the client, not estimated by us
- No information that could endanger a victim, witness or source
- Nothing published while a related prosecution is open, unless authorities agree
Start an engagement
Bring us the question nobody else could answer.
Tell us what you need to know and why. A senior investigator will scope it with you, tell you candidly what open sources can and cannot establish, and propose a plan with a fixed fee and a firm timeline.