Governments have long warned against paying a hacker’s ransom, arguing that doing so only allows Criminals benefit from their cyber attacks. and finance the next one. There’s another reason, too: hackers are unlikely to leave you alone if you pay once, and many will come back demanding more.
In a report released Wednesday, cybersecurity giant Proofpoint said it surveyed 953 companies and found that more than a third of companies that paid a hacker’s ransom were hit by a second extortion demand. The findings underscore the long-held understanding among security researchers and network defenders that it is impossible to negotiate in good faith with an extortion racket because there is no incentive for the other party to actually back away.
Proofpoint data shows that ransomware and extortion attacks have evolved from a single transaction in which hackers got paid once and moved on, to an effort that uses multiple forms of leverage, such as retaining stolen data under the threat of public disclosure.
While hackers have claimed in the past that they will delete or destroy a victim’s stolen data, past incidents have shown that is not the case.
Last month, a hack of market research firm Klue was exposed. data belonging to your clientsincluding several cybersecurity companies. The company said it reached a settlement with the hackers, who claimed to have deleted the data, but the company later admitted that an independent hacking group stole a sample of the company’s stolen data, leaving its customers exposed to possible future extortion claims.
A similar situation occurred in Change Healthcare in 2024, after a Russian-speaking ransomware gang stole the medical and health data of the majority of the US population, some 192 million people. Amid a dispute between hackers and their affiliates (criminal groups often subcontract attacks), Change Healthcare paid separate ransoms both groups of criminals to keep confidential medical data off the Internet.
Security researchers have long suspected that ransomware gangs and extortion networks will retain a victim’s stolen data even after payment is made. UK authorities confirmed this during their decommissioning efforts targeting the prolific LockBit ransomware gang in 2024. Police said they found the victims’ stolen data stored on LockBit’s servers long after the ransom had been paid.
When you purchase through links in our articles, we may earn a small commission. This does not affect our editorial independence.
