// Context
About This Negotiation
This transcript documents a Akira ransomware negotiation with a redacted victim organisation.
The negotiation consisted of 72 messages exchanged over Unknown.
The initial ransom demand was $450,000. The negotiation resulted in a confirmed payment.
// Primary Source
Full Transcript — Verbatim
Reproduced from Casualtek's Ransomchats archive. URLs have been redacted.
Victim names are shown only where the breach was publicly reported in mainstream media. Any organisation wishing their name redacted can contact us at
enquiries@binary-response.com — we will act promptly.
[Victim] — — Message 1/72
> We would like to know what data you took from us
[Akira] — — Message 2/72
> Hello. You've reached an Akira support chat. Currently, we are preparing the list of data we took from your network. For now you have to know that dealing with us is the best possible way to settle this quick and cheap. Keep in touch and be patient with us. We will reach out to you soon. Do you have a permission to conduct a negotiation on behalf of your organization? Once we get a response you will be provided with all the details.
[Victim] — — Message 3/72
> Yes
[Akira] — — Message 4/72
> list (20).txt // 798 KB
[Akira] — — Message 5/72
> These files were taken from your network prior to encryption. You can pick 2-3 random files up to 10 MB each from the list and we will upload them to this chat as a proof of possession. To prove that we can properly decrypt your data you can upload 2-3 encrypted files up to 10 MB each to our chat and we will upload decrypted copies back.
We're looking through your financial papers to come up with a reasonable demand to you. We offer: 1) full decryption assistance;
2) evidence of data removal;
3) security report on vulnerabilities we found;
4) guarantees not to publish or sell your data;
5) guarantees not to attack you in the future.
Let me know whether you're interested in a whole deal or in parts. This will affect the final price.
[Victim] — — Message 6/72
> Thank you for sharing this information and the file list. We'll review everything and follow up with you on Monday.
[Akira] — — Message 7/72
> Waiting.
[Victim] — — Message 8/72
> Taking more time than we thought to check this list. Need until tomorrow if thats okay
[Akira] — — Message 9/72
> That's is not okay. Provide a file request today.
[Victim] — — Message 10/72
> We first contacted you over the weekend and we haven't had enough time to check this list. It's not the easiest thing to skim through all of these directories.
[Akira] — — Message 11/72
> You can ask for any not large file from the list. It doesn't take much time.
[Victim] — — Message 12/72
> Sorry for the wait. Still understanding the data but please send these
[Victim] — — Message 13/72
> E:\[redacted].com\[redacted].docx
[Victim] — — Message 14/72
> E:\[redacted].com\[redacted].xlsx
[Victim] — — Message 15/72
> E:\[redacted].com\[redacted].xlsx
[Akira] — — Message 16/72
> Files.rar // 1.93 MB
[Akira] — — Message 17/72
> Here are the files. Do you want to test our decryption tool?
[Victim] — — Message 18/72
> Yes, how does that work?
[Akira] — — Message 19/72
> Are you trying to stall? To prove that we can properly decrypt your data you can upload 2-3 encrypted files up to 10 MB each to our chat and we will upload decrypted copies back. Waiting for the files today.
[Akira] — — Message 20/72
> We're willing to set a $450,000 price for ALL the services we offer. Waiting for your files today.
[Victim] — — Message 21/72
> [redacted].jpg.akira // 37.7 KB
[Victim] — — Message 22/72
> [redacted].docx.akira // 155 KB
[Victim] — — Message 23/72
> Please bear with us. We don't want to create an error so we are following your guidance. Can you fix these?
[Akira] — — Message 24/72
> Please wait.
[Akira] — — Message 25/72
> Decrypted.7z // 148 KB
[Akira] — — Message 26/72
> Here are the files. Are you ready to proceed with payment?
[Victim] — — Message 27/72
> Can we slow down just a bit? We're checking these files but you're asking us for almost half a million. Other companies just pay you instantly?
[Akira] — — Message 28/72
> Yes, they do. You have until tomorrow to review the files. We have to move to payment.
[Victim] — — Message 29/72
> We need to set this straight. We reached out to you over the weekend and we've spent each weekday trying to turn on our bricked computers, which has been a slow process. We've also been reviewing your list and now you're asking for $450,000. We're a small shop out of [redacted], not some large corporation in a big city. Can we get more than 1 day to wrap our heads around all of this?
[Akira] — — Message 30/72
> How much time do you want to gather the amount?
[Victim] — — Message 31/72
> We can't promise any sort of payment at this rate but Tuesday should give us enough time to see how this may play out. I don't handle our finances but I know this is going to be quite the exercise to see what we can come up with.
[Akira] — — Message 32/72
> We cannot give you until Tuesday. We will give you until Thursday evening the latest.
[Victim] — — Message 33/72
> That's tomorrow...
[Victim] — — Message 34/72
> We have a handful of employees. We don't make millions and millions in revenue. How do you expect us to evaluate all of this in 24 hours? If we can't have time, then we have no idea how we're going to work with you.
[Akira] — — Message 35/72
> Just give us an update on Thursday evening. If you pay this week, we can make a good discount.
[Victim] — — Message 36/72
> I wanted to get back to you before the evening. I really wish I had a better answer but right now the only thing we have available is some petty cash for a few thousand. We need to meet with our accountant since he knows more about this finance stuff and he's not back until next week. This is a lot more serious than we thought and I don't want to lost contact with you. Can you wait for him to get back so we can see what options we have?
[Akira] — — Message 37/72
> We can wait till Monday for a serious counter offer. The incident will be announced if your number is inadequate.
[Victim] — — Message 38/72
> I think we can make that work
[Akira] — — Message 39/72
> Hope so.
[Akira] — — Message 40/72
> What's your offer?
[Victim] — — Message 41/72
> Our accountant is still performing an analysis but I told them that we need to get some sort of response to you today. Nothing is finalized but for now he's comfortable offering $80,000. I don't know how to even get this money to you but is this something you can allow?
[Akira] — — Message 42/72
> This doesn't work. $80,000 offer is too far from our demand. We do not work with 5 figure amounts. Update your offer today, if you don't want us to announce the incident.
[Victim] — — Message 43/72
> The accountant is still reviewing our financials. It's been even harder since he doesn't have access to some of the drives. This isn't our final number but there's nothing else he can provide today. He's going through dozens of reports and re-calculating some of the locked data so he's going to need a few days to figure this out.
[Akira] — — Message 44/72
> We will not give more than 24 hours. Hurry up.
[Victim] — — Message 45/72
> If we keep getting these short deadlines, then we're going to continue coming up short. It's just a few of us that work here and each day has been painful for us. We don't have access to our files and we're trying to come up with a price that feels unfair. If you're not going to meet us on the price, then please give us enough time to actually give you a proper response. We don't need a whole week, just a few days.
[Akira] — — Message 46/72
> You have the deadline. No one is going to drag this out.
[Victim] — — Message 47/72
> So we have like 2-3 days? That's all we need.
[Akira] — — Message 48/72
> No, we can't give you 3 days. Update us on Tuesday evening. We will decide how to proceed with you.
[Victim] — — Message 49/72
> We'll try but we really don't know what we can come up with in a few hours...
[Akira] — — Message 50/72
> You have to take it seriously. We will not wait long.
[Victim] — — Message 51/72
> Ok this is where we're at. The accountant said that we were already in bad shape to start the year and the budget was trimmed because our profits aren't getting better. We may be able to sideline a small project to come up with more cash for you, but anything more and we're going to need help from the bank. There is nothing else left for now. To sum it up, we can pay $103,000 now. Anything more will require help from the bank.
[Akira] — — Message 52/72
> This is something already. You can understand that you are still far from our demand but we are open to work with you. So, the leadership decided to make a big step towards you and we are ready to accept $400,000 if you pay this week.
[Victim] — — Message 53/72
> $400,000? This week?
[Victim] — — Message 54/72
> Is this some sort of a trick? How do you think we'll 4x our offer in 3 days?
[Akira] — — Message 55/72
> Take a loan or try to borrow. Ask your accountant. You have a few hundred thousands in cash and a couple of dozens in assets.
[Victim] — — Message 56/72
> I don't know much about the financials but I know our accountant has said multiple times that we are already in a lot of debt. If there's any chance of borrowing then that will take time too. I hate sounding like a broken record constantly asking for time, but you need to give us something to work off of. Can we get the rest of this week to see our options then update you on Monday?
[Akira] — — Message 57/72
> We cannot wait that long. Update us on Thursday evening the latest.
[Victim] — — Message 58/72
> We have a few banks that we normally work with and I can guarantee that they won't sign off on a loan in 48 hours. We're at their mercy if we go down this path so Thursday won't work.
[Akira] — — Message 59/72
> Do your best. We believe you will make it.
[Victim] — — Message 60/72
> Just letting you know we are still working on this, but it's moving slowly. We're at the mercy of the banks right now
[Akira] — — Message 61/72
> Keep us posted on your progress.
[Victim] — — Message 62/72
> We certainly will. We want this resolved just as much as you do.
[Akira] — — Message 63/72
> Waiting.
[Akira] — — Message 64/72
> What's your progress?
[Victim] — — Message 65/72
> We just received word from the bank working with us that they won't have a decision on the loan until next weekend. Either Monday or Tuesday.
[Victim] — — Message 66/72
> We have to keep providing them with documentation of our financials so we can justify the amount of the loan so there is a lot involved.
[Akira] — — Message 67/72
> You have to push your bank to get a quicker decision from them. The deadline is Monday. If you provide little or no offer, we will announce the incident incident.
[Victim] — — Message 68/72
> If we had that power we would tell them that, but it's a bank and we need something from them. They aren't going to just give us money without doing their due diligence.
[Victim] — — Message 69/72
> We will let you know on Monday if we have their decision or not.
[Akira] — — Message 70/72
> Ok. We will see on Monday whether your data be published or not.
[Akira] — — Message 71/72
> You have 24 hours to give us your decision regarding this deal. If you stay silent, we will announce the breach on our blog.
[Akira] — — Message 72/72
> You can find your company name in our news column:
[REDACTED URL]
If you want this post deleted, we must come to an agreement.