Akira Ransomware Negotiation — Redacted Organisation

6Messages
UnknownDuration
$2.1MInitial Demand
UnknownOutcome

About This Negotiation

This transcript documents a Akira ransomware negotiation with a redacted victim organisation. The negotiation consisted of 6 messages exchanged over Unknown.

The initial ransom demand was $2.1M. The final outcome is not confirmed in the transcript.

Full Transcript — Verbatim

Reproduced from Casualtek's Ransomchats archive. URLs have been redacted.

Victim names are shown only where the breach was publicly reported in mainstream media. Any organisation wishing their name redacted can contact us at enquiries@binary-response.com — we will act promptly.
[Akira] — — Message 1/6
> Hello. You've reached Akira support chat. Currently, we are preparing the list of data we took from your network. For now you have to know that dealing with us is the best possible way to settle this quick and cheap. Keep in touch and be patient with us. Do you have a permission to conduct a negotiation on behalf of your organization? Once we get your reply you will be provided with all the details.
[Victim] — — Message 2/6
> Yes, please what now?
[Akira] — — Message 3/6
> Listing.7z // 608 KB
[Akira] — — Message 4/6
> These files were taken from your network prior to encryption. You can pick 2-3 random files up to 10 MB each from the list and we will upload them to this chat as a proof of possession. To prove that we can properly decrypt your data you can upload 2-3 encrypted files up to 10 MB each to our chat and we will upload decrypted copies back. We're looking through your financial papers to come up with a reasonable demand to you. We offer: 1) full decryption assistance; 2) evidence of data removal; 3) security report on vulnerabilities we found; 4) guarantees not to publish or sell your data; 5) guarantees not to attack you in the future. Let me know whether you're interested in a whole deal or in parts. This will affect the final price. If we don't get a respond within next 24 hours, we will be forced to announce your corporate data leak on our blog.
[Akira] — — Message 5/6
> We're willing to set a $2,100,000 price for ALL the services we offer.
[Akira] — — Message 6/6
> You have 24 hours to give us your decision regarding this deal. If you stay silent, we will announce the breach on our blog.

Analyst Observations

Facing a Ransomware Demand?

Whether you choose to negotiate or refuse — having specialists in the room changes the outcome.