3 ms·

It's been a week or more since this story first broke. I'm surprised the hackers haven't released all the info as a warning about what happens if you don't pay

It's been a week or more since this story first broke. I'm surprised the hackers haven't released all the info as a warning about what happens if you don't pay up in a timely manner.

paulpauper 6y ago
maybe they are bluffing
- duckfang 6y ago
  They're not bluffing. hXXp:// wavbeudogz6byhnardd2lkp2jafims3j7tj6k6qnywchn2csngvtffqd DOT onion/blog/040c040c85339ebb4b2a8f8d865b4d2c5c83121b48c8dfde5436a78b113919fa/ (from Babuk) "The negotiations reached a dead end, the amount we were offered does not suit us, we are posting 20 more personal files on officers, you can download this archive, the password will be released tomorrow. if during tomorrow they do not raise the price, we will release all the data." The password AND link to a 161MB rar file is present and working.
bena 6y ago
Blackmail is a gun with one bullet that can only shoot one target. Once you release the information, you can never get paid. Any leverage you had is gone. So if the goal is to get paid, releasing the information is actually counter-productive. Blackmail is a game of chicken.
- natmaka 6y ago
  As a gang with a "provable" identity and a will to avoid any latency they may release those data as a way to "educate" their future victims.
  - bena 6y ago
    First, that assumes that people are rational actors. They are not. Second, if these people were trustworthy, they wouldn't be blackmailing you in the first place. And once they get the money, what's to stop them from asking for more? It's not like they stop having the information once they get paid.
    - natmaka 6y ago
      People are not _always_ rational nor _never_ rational. We probably fundamentally agree: in my opinion one should not concede to a blackmail, in order to destroy blackmailing. However the associated cost, for the victim, may be very high, roughly a sacrifice. Such blackmailing works because there are known cases of ransoms paid, leading to recovery without any known after-shock (in 2020, as far as I understand: Tillamook and also Delaware County, Florence, Utah Univ, CWT...). Not sticking to this behavior would be a threat to the ransomware "business", and people gaining from it are probably rational to the point of trying to preserve it. Most, even quite dumb, don't kill the goose that lays golden eggs. Moreover in some cases the victim lost access to at least part of data vital to its operations, and pays in order to survive. Releasing data stolen to a victim plainly refusing to pay or even simply trying to play for time sends a powerful signal to future victims.

It's been a week or more since this story first broke. I'm surprised the hackers haven't released all the info as a warning about what happens if you don't pay up in a timely manner.

paulpauper 6y ago

maybe they are bluffing

duckfang 6y ago
They're not bluffing. hXXp:// wavbeudogz6byhnardd2lkp2jafims3j7tj6k6qnywchn2csngvtffqd DOT onion/blog/040c040c85339ebb4b2a8f8d865b4d2c5c83121b48c8dfde5436a78b113919fa/ (from Babuk) "The negotiations reached a dead end, the amount we were offered does not suit us, we are posting 20 more personal files on officers, you can download this archive, the password will be released tomorrow. if during tomorrow they do not raise the price, we will release all the data." The password AND link to a 161MB rar file is present and working.

bena 6y ago

Blackmail is a gun with one bullet that can only shoot one target. Once you release the information, you can never get paid. Any leverage you had is gone. So if the goal is to get paid, releasing the information is actually counter-productive. Blackmail is a game of chicken.

natmaka 6y ago
As a gang with a "provable" identity and a will to avoid any latency they may release those data as a way to "educate" their future victims.
- bena 6y ago
  First, that assumes that people are rational actors. They are not. Second, if these people were trustworthy, they wouldn't be blackmailing you in the first place. And once they get the money, what's to stop them from asking for more? It's not like they stop having the information once they get paid.
  - natmaka 6y ago
    People are not _always_ rational nor _never_ rational. We probably fundamentally agree: in my opinion one should not concede to a blackmail, in order to destroy blackmailing. However the associated cost, for the victim, may be very high, roughly a sacrifice. Such blackmailing works because there are known cases of ransoms paid, leading to recovery without any known after-shock (in 2020, as far as I understand: Tillamook and also Delaware County, Florence, Utah Univ, CWT...). Not sticking to this behavior would be a threat to the ransomware "business", and people gaining from it are probably rational to the point of trying to preserve it. Most, even quite dumb, don't kill the goose that lays golden eggs. Moreover in some cases the victim lost access to at least part of data vital to its operations, and pays in order to survive. Releasing data stolen to a victim plainly refusing to pay or even simply trying to play for time sends a powerful signal to future victims.