A processor implemented method comprising: identifying electronic communication data of an electronic communication between a first user and a second user, the electronic communication data comprising a plurality of data items including an identifier of the first user and a data item associated with the second user, the identifier generated using a private key of an asymmetric key pair and the data item associated with the second user generated using a public key of the asymmetric key pair, the first user being an agent user of an online entity; generating a cryptographic entry using the electronic communication data, the cryptographic entry including a plurality of cipher texts generated by encrypting the plurality of data items using a block cipher to generate a data structure (400, 500) comprising a row in a table with each data item of the plurality of data items having a corresponding cypher text lying in a column of a plurality of columns, wherein for each column a nonce is concatenated with a counter value for each column and input into the cipher block to generate scrambled values, and each scrambled value is XORed with a respective data item of the plurality of data items to generate values for the cipher texts; storing the cryptographic entry in the data structure (400, 500), including storing the cipher texts and the scrambled values for each column; receiving a notification indicating potential malicious activity involving the electronic communication; receiving, from a third user, a request for one or more data items from the plurality of data items in the cryptographic entry, wherein the request specifies the one or more data items to be exposed; transmitting the request to the second user; receiving, from the second user, authorization to expose the one or more data items; selectively exposing (620, 925) the one or more data items from the plurality of data items in block cipher decrypted form based on the one or more data items identified in the received authorization, by selectively decrypting each column of the cipher texts corresponding to the data items using the cipher block by XORing each cipher text with a respective scrambled value, and including transmitting the one or more data items to the third user; and causing a display of the one or more data items on a display device of the third user. identifying electronic communication data of an electronic communication between a first user and a second user, the electronic communication data comprising a plurality of data items including an identifier of the first user and a data item associated with the second user, the identifier generated using a private key of an asymmetric key pair and the data item associated with the second user generated using a public key of the asymmetric key pair, the first user being an agent user of an online entity; generating a cryptographic entry using the electronic communication data, the cryptographic entry including a plurality of cipher texts generated by encrypting the plurality of data items using a block cipher to generate a data structure (400, 500) comprising a row in a table with each data item of the plurality of data items having a corresponding cypher text lying in a column of a plurality of columns, wherein for each column a nonce is concatenated with a counter value for each column and input into the cipher block to generate scrambled values, and each scrambled value is XORed with a respective data item of the plurality of data items to generate values for the cipher texts; storing the cryptographic entry in the data structure (400, 500), including storing the cipher texts and the scrambled values for each column; receiving a notification indicating potential malicious activity involving the electronic communication; receiving, from a third user, a request for one or more data items from the plurality of data items in the cryptographic entry, wherein the request specifies the one or more data items to be exposed; transmitting the request to the second user; receiving, from the second user, authorization to expose the one or more data items; selectively exposing (620, 925) the one or more data items from the plurality of data items in block cipher decrypted form based on the one or more data items identified in the received authorization, by selectively decrypting each column of the cipher texts corresponding to the data items using the cipher block by XORing each cipher text with a respective scrambled value, and including transmitting the one or more data items to the third user; and causing a display of the one or more data items on a display device of the third user.