A hacker extorted a large company and threatened to distribute personal details of customers if no significant ransom money was paid. To do this he used an anonymous wireless Internet connection, each time from different cafes. Negotiations, forensics, and the integration of advanced technological capabilities led to the real-time detection of the suspect, while he was sending another email from one of the cafes. The transfer of treatment to us would lead to immediate actions to reduce the damage or even to prevent it. Another way of action involves closely monitoring the enforcement process while maintaining the digital evidence required for the police investigation and maintaining close contact with the investigation unit in order to protect the client's interests and assist in promoting it.