26/08/2026
At first, you might think the most surprising thing about this ransomware research is the amount of money involved 🤑
But I think it’s how normal some of the conversations sounded…
Researchers analysed hundreds of negotiations between ransomware gangs and the businesses they attacked.
In many cases the criminals behaved less like stereotypical hackers and more like aggressive salespeople.
They offered discounts for quick responses.
They split their demands into separate “services”.
Some even offered what they described as security reports or audits afterwards 🤯
As bizarre as that sounds, it tells you something important about how organised ransomware has become.
This is no longer somebody randomly locking files and demanding money.
These groups understand negotiation, pressure, and human behaviour extremely well.
In many attacks, the first demand isn’t even the amount the criminals expect to receive.
The research found businesses often negotiated the price down significantly, sometimes by huge amounts 💰
The attackers also leaned heavily on urgency ⏰
If the victim delayed, the price might increase.
If they responded quickly, a discount appeared.
Threats to leak stolen data were common too, along with warnings about contacting the press or exposing compliance failures.
The goal is to make people panic and react emotionally rather than think clearly.
In many cases, data is stolen first and then used as leverage during the negotiation.
And even if criminals promise to delete that information after payment, there’s no reliable way to verify they will.
You’re relying entirely on trust in a criminal organisation. Which obviously isn’t a great position to be in 😬
When an attack happens, businesses suddenly face operational disruption, customer concerns, legal questions, financial pressure, and difficult decisions all at the same time.
You must be prepared.
Having strong backups is vital, but so is knowing who would lead the response, how communication would work, and what steps would happen first if systems suddenly became unavailable.
👉 If your systems went offline tomorrow morning, do you think your business would know what to do first?
