3 ms·

It's much simpler: paying will result in more crime like this.

by jacquesm 1y ago

hmottestad 1y ago
You never know. Pay them enough and they might retire to an island somewhere instead.
- lotsofpulp 1y ago
  Islands are pretty expensive to live on. If anything, retiring on the island will require more crime.
- billy99k 1y ago
  The only reason these persist is because companies pay out and they can receive it in untraceable crypto currency in countries that are nearly to prosecute them in. Appeasement has never worked.
  - anonym29 1y ago
    Ransomware existed before cryptocurrency, and BTC is extremely traceable - far more traceable than cash, for instance. The only factor that matters is the adversaries residing in a jurisdiction with a lack of enforcement.
  - makeitdouble 1y ago
    > The only reason these persist You make it sound like a simplistic game with set rules. There will be myriads of other reasons to breach companies, and even strictly sticking to the money part, doing ransom/extortion can have secondary and tertiary effects worth enough to do it even if the ransom fails. If you look at it as a market, the victim is only one actor among many.
- gnfargbl 1y ago
  The current groups, sure, but the existence of a functioning market tends to bring in more participants. Or to put it another way, there are plenty of smart people in the world who found themselves born in a less-than-ideal country and are willing to solve their problems through crime. The only sustainable solution is to make crime no longer pay. Nothing else will work.
  - clayhacks 1y ago
    The other solution is making those “less than ideal” countries have more attractive legal economic opportunities so that crime isn’t an attractive alternative. Basically making crime no longer pay best
    - naldb 1y ago
      That requires cultural changes through a timescale of generations, so it’s not a feasible solution.
  - Razengan 1y ago
    Or let those smart people easily move to little-bit-more-ideal countries.
    - anonym29 1y ago
      Fun fact: emigration laws in despotic third-world shitholes ruled by autocrats aren't the same emigration laws that privileged westerners enjoy.
- bilekas 1y ago
  If you send me 200 million I will put that to the test for you.
- hollerith 1y ago
  He wrote "more crime like this", not "more crime like this committed by the same group".
- JumpCrisscross 1y ago
  > Pay them enough and they might retire to an island somewhere instead. Why wouldn't they do that and sell the data?
makeitdouble 1y ago
That's the official stance, but if it really mattered they'd pay. And there's of course paths to pay without losing face, like hiring a negociator or a recovery firm that acts like a bridge for the money[0]. We came to accept that companies don't act ethically and will only maximize profit, yet the narrative is still stuck on that weird assumption they care about the future of society regarding ransomware. [0] https://zendata.security/2025/07/08/ransomware-negotiator-scandal-rocks-recovery-industry/ https://zendata.security/2025/07/08/ransomware-negotiator-sc...
- spwa4 1y ago
  Shouldn't the company be punished for the security failure in the first place? It might even be helpful: you could prevent the incentive to pay for security breaches regardless of the negotiation outcome.
  - jacquesm 1y ago
    > Shouldn't the company be punished for the security failure in the first place? Yes. The GDPR has provisions for this. But enforcement is still relatively light.
cakealert 1y ago
Tragedy of the commons. It's irrelevant to the extorted company whether or not it becomes more common in the future, they have a much bigger problem now. The reason they didn't pay is because they conducted a cost benefit analysis and decided it's not worth it to them.
- bigbadfeline 1y ago
  > It's irrelevant to the extorted company whether or not it becomes more common in the future, they have a much bigger problem now. No, it's not irrelevant because that future might be tomorrow. The criminals remain in possession of the data whether they get paid or not, that is, the extortion can be restarted the next day (or hour) after payment. There's no way to trust an anonymous group you know nothing about, be it to keep their word or to keep your data safe from individual members or splintering groups.
  - cakealert 1y ago
    That would be part of the cost benefit analysis. And you would be surprised how "trustworthy" these ransomware groups are. Probably because publishing the data is a hassle they would rather do without, and finding actual buyers for such data is hard (corporations don't tend to have black budgets). No, whenever they decide not to pay it's because they made the decision to absorb the damage rather than pay criminals who may or not be sanctioned (and that fact may later emerge) creating additional liability. So you know that when they pay the damage would have been very great indeed. In this instance the damage is likely minor or more likely, off-sourced. Nobody is not going to pay because that will be better for the collective to let the ransomware industry die. They may however choose to publicly state that as the reason.
  - deleted 1y ago
    [deleted]

It's much simpler: paying will result in more crime like this.

hmottestad 1y ago

You never know. Pay them enough and they might retire to an island somewhere instead.

lotsofpulp 1y ago
Islands are pretty expensive to live on. If anything, retiring on the island will require more crime.
billy99k 1y ago
The only reason these persist is because companies pay out and they can receive it in untraceable crypto currency in countries that are nearly to prosecute them in. Appeasement has never worked.
- anonym29 1y ago
  Ransomware existed before cryptocurrency, and BTC is extremely traceable - far more traceable than cash, for instance. The only factor that matters is the adversaries residing in a jurisdiction with a lack of enforcement.
- makeitdouble 1y ago
  > The only reason these persist You make it sound like a simplistic game with set rules. There will be myriads of other reasons to breach companies, and even strictly sticking to the money part, doing ransom/extortion can have secondary and tertiary effects worth enough to do it even if the ransom fails. If you look at it as a market, the victim is only one actor among many.
gnfargbl 1y ago
The current groups, sure, but the existence of a functioning market tends to bring in more participants. Or to put it another way, there are plenty of smart people in the world who found themselves born in a less-than-ideal country and are willing to solve their problems through crime. The only sustainable solution is to make crime no longer pay. Nothing else will work.
- clayhacks 1y ago
  The other solution is making those “less than ideal” countries have more attractive legal economic opportunities so that crime isn’t an attractive alternative. Basically making crime no longer pay best
  - naldb 1y ago
    That requires cultural changes through a timescale of generations, so it’s not a feasible solution.
- Razengan 1y ago
  Or let those smart people easily move to little-bit-more-ideal countries.
  - anonym29 1y ago
    Fun fact: emigration laws in despotic third-world shitholes ruled by autocrats aren't the same emigration laws that privileged westerners enjoy.
bilekas 1y ago
If you send me 200 million I will put that to the test for you.
hollerith 1y ago
He wrote "more crime like this", not "more crime like this committed by the same group".
JumpCrisscross 1y ago
> Pay them enough and they might retire to an island somewhere instead. Why wouldn't they do that and sell the data?

makeitdouble 1y ago

That's the official stance, but if it really mattered they'd pay. And there's of course paths to pay without losing face, like hiring a negociator or a recovery firm that acts like a bridge for the money[0]. We came to accept that companies don't act ethically and will only maximize profit, yet the narrative is still stuck on that weird assumption they care about the future of society regarding ransomware. [0] https://zendata.security/2025/07/08/ransomware-negotiator-scandal-rocks-recovery-industry/ https://zendata.security/2025/07/08/ransomware-negotiator-sc...

spwa4 1y ago
Shouldn't the company be punished for the security failure in the first place? It might even be helpful: you could prevent the incentive to pay for security breaches regardless of the negotiation outcome.
- jacquesm 1y ago
  > Shouldn't the company be punished for the security failure in the first place? Yes. The GDPR has provisions for this. But enforcement is still relatively light.

cakealert 1y ago

Tragedy of the commons. It's irrelevant to the extorted company whether or not it becomes more common in the future, they have a much bigger problem now. The reason they didn't pay is because they conducted a cost benefit analysis and decided it's not worth it to them.

bigbadfeline 1y ago
> It's irrelevant to the extorted company whether or not it becomes more common in the future, they have a much bigger problem now. No, it's not irrelevant because that future might be tomorrow. The criminals remain in possession of the data whether they get paid or not, that is, the extortion can be restarted the next day (or hour) after payment. There's no way to trust an anonymous group you know nothing about, be it to keep their word or to keep your data safe from individual members or splintering groups.
- cakealert 1y ago
  That would be part of the cost benefit analysis. And you would be surprised how "trustworthy" these ransomware groups are. Probably because publishing the data is a hassle they would rather do without, and finding actual buyers for such data is hard (corporations don't tend to have black budgets). No, whenever they decide not to pay it's because they made the decision to absorb the damage rather than pay criminals who may or not be sanctioned (and that fact may later emerge) creating additional liability. So you know that when they pay the damage would have been very great indeed. In this instance the damage is likely minor or more likely, off-sourced. Nobody is not going to pay because that will be better for the collective to let the ransomware industry die. They may however choose to publicly state that as the reason.
- deleted 1y ago
  [deleted]