Ransomware Extortion Demands Return, Hackers Come Back for More

Governments have long warned against paying a hacker's ransom, arguing that it only funds the next attack and provides no guarantee of safety. A new report from cybersecurity giant Proofpoint confirms that this is indeed the case.

Cybersecurity giant Proofpoint surveyed 953 companies and found that over one-third of companies that paid a hacker's ransom were hit with a second extortion demand. This finding underscores the long-held understanding among security researchers and network defenders that it's impossible to negotiate in good faith with an extortion racket because there's no incentive for the other side to actually walk away.

Proofpoint's data shows that ransomware attacks and extortion attacks have evolved from a single transaction where hackers would get paid once and move on, into an effort using multiple forms of leverage, such as retaining stolen data under the threat of publicly releasing it.

While hackers have claimed in the past that they will delete or destroy the victim's stolen data, past incidents have shown that not to be the case.

• In a hack at market research firm Klue, data belonging to its customers, including several cybersecurity firms, was exposed. The company said it struck a deal with the hackers, who claimed to have deleted the data, but the company later conceded that a separate hacking group swiped a sample of the company's stolen data, leaving its customers exposed to potential future extortion demands.
• A similar situation befell Change Healthcare in 2024, after a Russian-speaking ransomware gang stole the health and medical data of the majority of people in America, some 192 million people. Amid a dispute between the hackers and their affiliates, Change Healthcare paid separate ransoms to both groups of criminals to keep the sensitive medical data off of the internet.

Security researchers have long suspected that ransomware gangs and extortion rackets will keep hold of the victim's stolen data, even after a payment is made. U.K. law enforcement confirmed this during their takedown efforts targeting the prolific LockBit ransomware gang in 2024. Police said that they found victims' stolen data stored on LockBit's servers long after they had paid the ransom.

The Dangers of Paying Ransom

Paying a hacker's ransom may seem like the easiest way to resolve a cyberattack, but it's a short-sighted solution that can lead to further extortion demands. In fact, a report from cybersecurity firm Cybereason found that 61% of companies that paid a ransomware demand were targeted with another attack within a year.

What to Do Instead

If you're a victim of a ransomware attack, the best course of action is to not pay the ransom. Instead, contact your local law enforcement agency and report the incident. You should also reach out to a cybersecurity expert who can help you recover your data and prevent future attacks.

Conclusion

The findings from Proofpoint's report should serve as a warning to companies and individuals: paying a hacker's ransom is not a guarantee of safety, and it may even lead to further extortion demands. The best way to protect yourself from ransomware attacks is to have a robust cybersecurity plan in place and to never pay a hacker's ransom.