A notification pops up: the crypto transaction has confirmed. The wallet is legit. You decide to go all in. The PRAP manual was real; maybe the exposure band thresholds are too. You send FinanceGhost another $1,000 in crypto. > **FinanceGhost**: *"Smart move. Check your inbox."* A new file appears: **Exposure_Band_Thresholds_2023.xlsx**. You open it: - Green Band: exposure under $10M, no action required. - Amber Band: exposure between $10M and $50M, requires Isabella Laurent's approval to override alerts. - Red Band: exposure over $50M, automatic alert to the CFO and compliance. This is exactly what you need. With it you can predict when Isabella will override alerts (Amber Band), and work out what it would take to force a Red Band alert (push exposure over $50M). But now FinanceGhost knows you are serious, and he has already hinted at the employee contact. The laptop's fan whirs softly. **What do you do?** - $5K is steep, but a direct line into Blackridge could be worth it: [[Ask for Employee Contact|Ask for the employee contact]] - You have got enough for now: [[Cybercrime/The_Phisherman/Research Blackridge|Walk away and rely on public research]] - This is getting too expensive: [[Find a Data Leak|Cut ties and dig for the leak yourself]] <details> <summary>🔎 Behind the curtain: markets for stolen data</summary> <p>Buying a firm's internal documents from a stranger for crypto is not far-fetched. There is a real underground economy of <b>initial access brokers</b> and data sellers who trade stolen credentials, internal files and ready-made footholds into company networks, often on forums or encrypted chat, priced from a few dollars to many thousands. Ransomware crews routinely buy their way in rather than breaking in themselves. The catch, as the story keeps hinting, is trust: sellers lie, files are faked or planted, and a buyer can be scammed or set up just as easily as the eventual victim.</p> <p><b>Defender's lesson:</b> assume some of your internal files and logins are already for sale somewhere. Watching for leaked credentials, and treating any single stray document as possibly forged, both help.</p> </details>