{
  "docId": "019dd923-5e88-73ef-bd57-cf13ce8ed1d4",
  "docSlug": "72b88f635783ce33",
  "documentTitle": "incident response insights january 2025",
  "authorId": "BoozAllenHamilton",
  "authorName": "Booz Allen",
  "documentKindSlug": "consulting-deck",
  "documentKindLabel": "Consulting deck",
  "sourceTypeSlug": "strategy_consulting",
  "sourceTypeLabel": "Strategy consulting",
  "presentationDate": null,
  "orientation": "landscape",
  "aspectRatio": 1.778,
  "pageNumber": 5,
  "pageCount": 10,
  "prevPage": 4,
  "nextPage": 6,
  "slideType": "data_table",
  "function": "analyze_data",
  "density": "dense",
  "nDataPoints": 26,
  "notes": "The slide uses horizontal bar charts to compare ransom amounts across two quarters.",
  "elementsJson": [
    "bar_chart_horizontal",
    "bar_chart_horizontal",
    "paragraph"
  ],
  "metadataConfidence": 1,
  "imagePath": null,
  "slideHref": "/slides/019dd923-5e88-73ef-bd57-cf13ce8ed1d4/5",
  "deckHref": "/decks/019dd923-5e88-73ef-bd57-cf13ce8ed1d4",
  "deckJsonHref": "/decks/019dd923-5e88-73ef-bd57-cf13ce8ed1d4.json",
  "deckAnchorHref": "/decks/019dd923-5e88-73ef-bd57-cf13ce8ed1d4#slide-5",
  "components": [
    {
      "bbox": null,
      "kind": "callout",
      "text": "The ransom demand data for Q4 is heavily skewed by a threat actor making a 9-digit ransom demand for a single matter.",
      "attrs": null,
      "subkind": null,
      "toolName": "Visual emphasis",
      "toolSlug": "visual-emphasis",
      "confidence": null,
      "componentId": "019dd952-1043-7233-b236-8d408564844e",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.4,
        "w": 0.75,
        "x": 0.2,
        "y": 0.05
      },
      "kind": "chart",
      "text": "2024 Q4 (October, November, December) ransom demands",
      "attrs": null,
      "subkind": "bar-horizontal",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "6f6ed395-8cb0-46cd-bf5f-e7ed5ce2c874",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.4,
        "w": 0.75,
        "x": 0.2,
        "y": 0.5
      },
      "kind": "chart",
      "text": "2024 Q3 (July, August, September) ransom demands",
      "attrs": null,
      "subkind": "bar-horizontal",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "ad74a991-978f-473d-94d1-e3cce219e7b0",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": null,
      "kind": "metric",
      "text": "Ransom Demand: $131,270,000",
      "attrs": null,
      "subkind": "primary",
      "toolName": "Quantification",
      "toolSlug": "quantification",
      "confidence": null,
      "componentId": "019dd952-1043-7233-b236-93dd2b217743",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.1,
        "w": 0.15,
        "x": 0.05,
        "y": 0.55
      },
      "kind": "paragraph",
      "text": "In Q3 2024, Play Ransomware Group, FOG, RansomHub, Rhysida, Blacksuit and Akira have led on ransom demands.",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "0b2e534a-5c7c-43de-874a-2bf227c642eb",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.15,
        "w": 0.15,
        "x": 0.05,
        "y": 0.25
      },
      "kind": "paragraph",
      "text": "In Q42024, Blacksuit, RansomHub, Black Basta Group, Akira, Frag, Cactus Play Ransomware Group, Abyss Locker and Monti have led on ransom demands. The ransom demand data for Q4 is heavily skewed by a threat actor making a 9-digit ransom demand for a single matter.",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "cb2d47e5-ea91-415e-b4e9-03bd1b51dd27",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.05,
        "w": 0.15,
        "x": 0.05,
        "y": 0.18
      },
      "kind": "title",
      "text": "Ransom Demand By Threat Actors",
      "attrs": null,
      "subkind": "headline",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "2da28a86-f4d6-41e4-b8ca-ae5a59eeddd6",
      "frameworkName": null,
      "frameworkSlug": null
    }
  ],
  "metrics": [],
  "tools": [],
  "frameworks": [],
  "arcBeats": [
    {
      "to": 6,
      "from": 5,
      "beatId": "4acdfd36-78d5-49a0-8202-4da7ca3af4fc",
      "arcName": "The Sparkline",
      "arcSlug": "sparkline",
      "beatName": "Problem & Complication",
      "beatSlug": "consultants-gambit-problem-complication",
      "evidence": "Slides 5-6 present data tables on ransom demand by threat actors",
      "position": 2,
      "confidence": 0.8,
      "parentBeatName": "Complication",
      "parentBeatSlug": "complication"
    }
  ],
  "loops": [
    {
      "to": 6,
      "from": 5,
      "name": "Mece Breakdown",
      "slug": "40-mece-breakdown",
      "bestFor": "Problem structuring, ensuring completeness, strategic analysis",
      "matchId": "092d7f4b-4dd7-4f30-9c0a-1f27000e04ea",
      "evidence": "Slides 5-6 present data tables on ransom demand",
      "position": 1,
      "objective": "Analyze ransom demand by threat actors",
      "structure": "The Whole -> Category A (distinct) -> Category B (distinct) -> Category C (distinct) -> Complete Coverage",
      "confidence": 0.6,
      "description": "Divide a complex topic into mutually exclusive, collectively exhaustive categories"
    }
  ],
  "imagePathAlt": null,
  "thumbSrc": null,
  "thumbSrcAlt": null,
  "locked": true
}