Ransomware Negotiation Transcripts
235 real-world ransomware negotiations — the largest public archive. Browse by threat actor group to study their tactics, communication patterns, and what professional negotiation achieves.
This archive contains 235 ransomware negotiation transcripts across 24 threat actor groups, documenting 47 confirmed payments with an average demand reduction of 63% through professional negotiation. Groups covered include Akira (60 transcripts), LockBit 3.0 (43), Conti (32), REvil (20), DragonForce (14), and Trinity (14). Source data from Casualtek Ransomchats and ransomware.live. Maintained by Binary Response, publisher of the largest public archive of ransomware negotiation transcripts.
What Professional Negotiation Achieves
Across transcripts where both opening demand and final settlement are documented, professional negotiation achieves substantial demand reductions:
| Victim | Group | Opening Demand | Final Settlement | Reduction |
|---|---|---|---|---|
| Redacted Organisation | Conti | $1.7M | $175.00 | 100% |
| Redacted Organisation | Akira | $180,000 | $105.00 | 100% |
| Redacted Organisation | Akira | $400,000 | $300.00 | 100% |
| Redacted Organisation | Akira | $600,000 | $500.00 | 100% |
| Redacted Organisation | Conti | $850,000 | $635.00 | 100% |
| Redacted Organisation | BlackBasta | $700,000 | $12,900 | 98% |
| Redacted Organisation | Akira | $4.0M | $150,000 | 96% |
| Redacted Organisation | Conti | $9.1M | $450,000 | 95% |
| Redacted Organisation | Akira | $200,000 | $25,000 | 88% |
| Redacted Organisation | Conti | $950,000 | $170,000 | 82% |
| Redacted Organisation | Conti | $900,000 | $162,792 | 82% |
| Redacted Organisation | Conti | $920,000 | $172,000 | 81% |
| Redacted Organisation | Conti | $1.8M | $450,000 | 75% |
| Redacted Organisation | Akira | $750,000 | $225,000 | 70% |
| Redacted Organisation | Akira | $850,000 | $290,000 | 66% |
| Redacted Organisation | BlackBasta | $400,000 | $150,000 | 62% |
| Redacted Organisation | Akira | $250,000 | $100,000 | 60% |
| Redacted Organisation | Akira | $220,000 | $90,000 | 59% |
| Redacted Organisation | Conti | $600,000 | $256,000 | 57% |
| Redacted Organisation | Akira | $165,000 | $75,000 | 54% |
| Redacted Organisation | Conti | $980,000 | $500,000 | 49% |
| Redacted Organisation | Conti | $980,000 | $510,000 | 48% |
| Redacted Organisation | Akira | $400,000 | $250,000 | 38% |
| 058F4B92 Ae99 45C7 Bf35 5D2D6754B3De | Dragonforce | $1.5M | $1.0M | 33% |
| Redacted Organisation | Akira | $390,000 | $285,000 | 27% |
| Redacted Organisation | Akira | $200,000 | $150,000 | 25% |
| Redacted Organisation | Akira | $200,000 | $150,000 | 25% |
| Redacted Organisation | Akira | $450,000 | $400,000 | 11% |
| 20250203 From @Rakeshkrish12 | Qilin | $63,000 | $60,000 | 5% |
| Redacted Organisation | Mallox | $20,000 | $19,987 | 0% |
Settlement amounts in USD. Data sourced from Casualtek Ransomchats archive and public disclosures.
Browse by Threat Actor
235 transcripts across 24 ransomware and extortion groups. Select a group to see all available negotiations.
| Threat Actor Group | Transcripts | |
|---|---|---|
| Akira | 60 | transcripts |
| LockBit 3.0 | 43 | transcripts |
| Conti | 32 | transcripts |
| REvil | 20 | transcripts |
| DragonForce | 14 | transcripts |
| Trinity | 14 | transcripts |
| Hive | 8 | transcripts |
| Avaddon | 7 | transcripts |
| Fog | 6 | transcripts |
| BlackBasta | 5 | transcripts |
| DarkSide | 5 | transcripts |
| Mallox | 3 | transcripts |
| Babuk | 2 | transcripts |
| BlackMatter | 2 | transcripts |
| Cloak | 2 | transcripts |
| NoEscape | 2 | transcripts |
| Qilin | 2 | transcripts |
| Ranzy | 2 | transcripts |
| AvosLocker | 1 | transcript |
| Hunters International | 1 | transcript |
| Mount Locker | 1 | transcript |
| Pear | 1 | transcript |
| RansomHub | 1 | transcript |
| RunSomeWares | 1 | transcript |
235 transcripts total across 24 groups. Sorted by transcript count.
Victim names are shown only where the breach was publicly reported in mainstream media or disclosed by the organisation itself. For redacted transcripts, victim names and identifying details have been removed by the original researchers at Casualtek.
Any organisation wishing their information removed or updated should contact enquiries@binary-response.com — we will act promptly.
Source: Casualtek Ransomchats and ransomware.live.