🔐 Security Alert

When “Pen Testers” Become Extortionists — And Pick the Wrong Company

A self-described “pen tester” recently attempted to leverage a minor, transient HTTPS configuration gap — discovered during a scheduled server migration — into a payday. They picked the wrong company.

In the world of cybersecurity, legitimate vulnerability researchers are some of the most valuable allies a company can have. Responsible disclosure — finding an issue, reporting it through proper channels, and allowing a reasonable remediation window — is the foundation of ethical security research. It is built on trust, professionalism, and ethics.

What we experienced recently was none of that.

---

What Actually Happened

During a scheduled server and website migration, a brief gap occurred in our HTTPS certificate configuration. To be clear: this was a transient technical condition that arose during active maintenance — not a hidden flaw, not a chronic vulnerability, and not evidence of systemic negligence. These short-lived configuration states are a known and expected challenge during infrastructure transitions. Ours was addressed through standard remediation — and it was.

An individual who identified this condition did not reach out through our published responsible disclosure process. They did not submit a ticket. They did not request verification through our documented bug bounty protocol. They did not attempt to identify themselves through any of the professional channels a legitimate security researcher would instinctively use.

Instead, they made threats.

---

🚩 The Playbook of a Bad Actor

The individual threatened to publish information about the issue to YouTube and the dark web — the hallmark pressure tactics of someone trying to exploit a company’s fear of reputational damage rather than contribute to its security. They refused to verify their identity. They refused to follow any established protocol. Every element of their approach was designed to create panic and extract a payment — not to protect anyone.

---

🎯 This Pattern Preys on Small Businesses

We want to be direct: this almost certainly was not the first time this individual has attempted this scheme. The approach is too practiced, too structured in its pressure points. It relies on small businesses being caught off guard — companies without dedicated security teams, without legal counsel on retainer, and without the institutional knowledge to recognize a shakedown for what it is.

The calculation is cynical and deliberate: find a business, find any vulnerability (no matter how minor), refuse to follow proper channels, and threaten enough noise on social media that the business simply pays to make it go away. For many small businesses, it works. That is the tragedy of it.

We are not that business.

---

⚖️ What We Are Doing About It

This matter has been escalated through the appropriate legal and regulatory channels. All communications have been documented and preserved. Our Board has been informed. Our legal team is engaged. Relevant authorities — including those with jurisdiction over digital extortion and cybercrime — have been notified.

Refusal to identify oneself when making demands of this nature does not provide protection. It provides a trail — one that investigators are experienced at following.

---

✅ For Legitimate Security Researchers

We genuinely value the work of ethical security researchers. If you discover a vulnerability in our systems, here is how to engage with us properly:

• 1
  Contact us through our official published disclosure channels — do not use anonymous platforms or social media threats as your opening move.
• 2
  Be prepared to verify your identity. Legitimate researchers understand this is a standard and reasonable expectation.
• 3
  Provide a clear, technical description of the issue and allow a reasonable remediation window before any public disclosure.
• 4
  Engage with our bug bounty and recognition process in good faith. We reward responsible disclosure — always.

---

📢 The Bottom Line

We are an IT company. Security is not incidental to what we do — it is foundational to it. We have the expertise, the legal resources, and the institutional resolve to handle exactly this kind of situation. Attempting to extort an IT firm with a cybersecurity threat is, at best, a significant miscalculation.

We are publishing this post for one reason: awareness. If you are a small business owner who has been approached using these tactics, know that you have options. Document everything. Do not pay. Engage legal counsel. Report it. These actors depend on silence and fear — and both are negotiable.