// Context
About This Negotiation
This transcript documents a Akira ransomware negotiation with a redacted victim organisation.
The negotiation consisted of 20 messages exchanged over Unknown.
The initial demand is not clearly stated in the transcript. The final outcome is not confirmed in the transcript.
// Primary Source
Full Transcript — Verbatim
Reproduced from Casualtek's Ransomchats archive. URLs have been redacted.
Victim names are shown only where the breach was publicly reported in mainstream media. Any organisation wishing their name redacted can contact us at
enquiries@binary-response.com — we will act promptly.
[Victim] — — Message 1/20
> hi
[Victim] — — Message 2/20
> hello
[Akira] — — Message 3/20
> Hello. You've reached an Akira support chat. Currently, we are preparing the list of data we took from your network. For now you have to know that dealing with us is the best possible way to settle this quick and cheap. Keep in touch and be patient with us. We will reach out to you soon. Do you have a permission to conduct a negotiation on behalf of your organization? Once we get a response you will be provided with all the details.
[Victim] — — Message 4/20
> yes, i have permission
[Victim] — — Message 5/20
> requesting sample data of [redacted]
[Akira] — — Message 6/20
> List.rar // 19.8 KB
[Akira] — — Message 7/20
> These files were taken from your network prior to encryption. You can pick 2-3 random files up to 10 MB each from the list and we will upload them to this chat as a proof of possession. To prove that we can properly decrypt your data you can upload 2-3 encrypted files up to 10 MB each to our chat and we will upload decrypted copies back. We're looking through your financial papers to come up with a reasonable demand to you. We offer: 1) full decryption assistance;
2) evidence of data removal;
3) security report on vulnerabilities we found;
4) guarantees not to publish or sell your data;
5) guarantees not to attack you in the future. Let me know whether you're interested in a whole deal or in parts. This will affect the final price.
[Akira] — — Message 8/20
> Are you going to work with us?
[Akira] — — Message 9/20
> What do you mean "requesting sample data of [redacted]"?
[Victim] — — Message 10/20
> I am looking for "[redacted]"
[Akira] — — Message 11/20
> Could you please be a little more specific?
[Victim] — — Message 12/20
> [redacted] is the tiny bearded man hiding inside your encrypter. I assume he leaves his name so he can be contacteed. I much desire to speak with him. If you don't know him contact your management.
[Akira] — — Message 13/20
> OK.
[Victim] — — Message 14/20
> Standing by.
[Akira] — — Message 15/20
> You can find your company name in our news column: [REDACTED URL] If you want this post to be removed, we have to agree on something.
[Victim] — — Message 16/20
> Hello there, I got this chat from a different attack, in fact my company has a different name. Can I have a separate Chat?
[Akira] — — Message 17/20
> From a different attack? What do you mean? What's your company name?
[Victim] — — Message 18/20
> [redacted]
[Akira] — — Message 19/20
> You're in the right place.
[Akira] — — Message 20/20
> You data will be published soon.