Surveying 953 companies, Proofpoint discovered that more than one-third of those who bowed to ransom demands were hit with secondary extortion attempts. Modern ransomware attacks have shifted from simple one-time transactions into complex schemes using stolen data as ongoing leverage. Hackers often claim they will destroy sensitive files once paid, yet evidence suggests they routinely retain the stolen information to secure future payouts.
Why Paying Ransom to Cybercriminals Often Leads to Repeated Extortion
Paying a ransom to hackers rarely settles the debt, according to new research from Proofpoint. Instead of walking away, cybercriminals frequently treat a successful payment as an invitation to return for more, proving that negotiating with an extortion racket is a losing game for companies and institutions alike.
The risks of compliance are evident in recent high-profile cases. Market research firm Klue paid a ransom based on promises that their stolen data would be deleted, only to find that other hacking groups had already acquired samples of the same information. Similarly, Change Healthcare faced a double-extortion scenario in 2024, paying multiple criminal factions to protect the medical records of approximately 192 million people. Even when ransoms are settled, the data remains a liability; U.K. law enforcement officials confirmed that during their 2024 crackdown on the LockBit gang, they discovered victim data still sitting on the group's servers long after payments had been made.
Comments (0)
No comments yet. Be the first!