// Context
About This Negotiation
This transcript documents a Akira ransomware negotiation with a redacted victim organisation.
The negotiation consisted of 25 messages exchanged over Unknown.
The initial ransom demand was $200,000. The negotiation resulted in a confirmed payment.
// Primary Source
Full Transcript — Verbatim
Reproduced from Casualtek's Ransomchats archive. URLs have been redacted.
Victim names are shown only where the breach was publicly reported in mainstream media. Any organisation wishing their name redacted can contact us at
enquiries@binary-response.com — we will act promptly.
[Victim] — — Message 1/25
> Hi friends, Thanks you for pointing out our security issues. Luckily, we succeeded to get 50% of our files back. However, we're still missing the other 50% (more or less). As there are mainly files we don't necessarly need to operate our current business (archives), we would like to know how much you are willing to accept in order to give us the encryption key?
[Akira] — — Message 2/25
> Hello. You've reached an Akira support chat. Currently, we are preparing the list of data we took from your network. For now you have to know that dealing with us is the best possible way to settle this quick and cheap. Keep in touch and be patient with us. We will reach out to you soon. Do you have a permission to conduct a negotiation on behalf of your organization? Once we get a response you will be provided with all the details.
[Victim] — — Message 3/25
> Thanks for your response. We do have permission to conduct a negotiation.
[Akira] — — Message 4/25
> List.7z // 200 KB
[Akira] — — Message 5/25
> These files were taken from your network prior to encryption. You can pick 2-3 random files up to 10 MB each from the list and we will upload them to this chat as a proof of possession. To prove that we can properly decrypt your data you can upload 2-3 encrypted files up to 10 MB each to our chat and we will upload decrypted copies back. We're looking through your financial papers to come up with a reasonable demand to you. We offer: 1) full decryption assistance;
2) evidence of data removal;
3) security report on vulnerabilities we found;
4) guarantees not to publish or sell your data;
5) guarantees not to attack you in the future. Let me know whether you're interested in a whole deal or in parts. This will affect the final price.
[Victim] — — Message 6/25
> Thank you for your proof of decryption of our file. We have indeed chosen to decrypt 3 files, as follows : (1) "C:\DATA\[redacted].pdf" (2) "C:\DATA\[redacted].pdf" (3) "C:\DATA\[redacted].docx". By the way, can you tell us the cost for the full package (1 to 5)? Thanks.
[Akira] — — Message 7/25
> Please wait.
[Akira] — — Message 8/25
> Files.docx.7z // 606 KB
[Akira] — — Message 9/25
> Here are the files. Do you want to test our decryption tool?
[Akira] — — Message 10/25
> We're willing to set a $200,000 price for ALL the services we offer. We accept payments in BTC. To gain bitcoins you need to go to any exchange platform as binance or coinbase. Here are the guides: [REDACTED URL]
[REDACTED URL] You also can buy bitcoin from any local brokers. If you withdraw funds from your bank account, then you have to inform the bank that you need this money for investment purposes only.
[Victim] — — Message 11/25
> 200K$? We don't have this money... If you look at our balance sheet, that is public [redacted], you can clearly see we have losses over the 3 past years and we don't have this money in our bank account... We can't ask for a loan as no bank will help us... What are the possibilities? What could be the lowest price for you?
[Victim] — — Message 12/25
> [redacted].idml.akira // 685 KB
[Victim] — — Message 13/25
> [redacted].idml.akira // 4.17 MB
[Victim] — — Message 14/25
> As proof of decryption, can you try to decrypt these 2 files? Thanks.
[Akira] — — Message 15/25
> Let us know what you are going to offer and we will discuss. Wait for decrypted files.
[Victim] — — Message 16/25
> As I mentionned, we already face a loss of 490K$ and have less than 80K$ left on our bank account, mainly reserved to pay the salaries of our employees the next month (22 people in 2025, 32 in 2024). If we pay more than 50K$, our company will shut down and we'll be forced to lay off everyone in the next couple of months... This is not what we want and that’s why I’m asking you to consider a final price of 50K$. In exchange, we agree to select options (1) Full decryption support and (4) Guarantee that our data will not be published or resold. It's simply the maximum we can pay to survive. I hope you can understand and accept this so we can resolve the situation quickly.
[Victim] — — Message 17/25
> If the answer is no, I understand, but I will have to inform my stakeholders, as I can't do more without consequences.
[Akira] — — Message 18/25
> Decrypted.7z // 4.08 MB
[Akira] — — Message 19/25
> Here are the files. Do you think the situation will get easier if you don't pay? If you really think so, you can log out right now as $50,000 will not be ever considered. Option 4 is only possible if you purchase option 2. So, if you only need our decryption tool, we can accept $150,000, but keep in mind that your data will be published.
[Victim] — — Message 20/25
> Thank you for your answer. We understand your position, but as mentioned before, we simply cannot go beyond 50K$. It’s a hard financial limit. We have no external funding, no insurance, and no loan access. Also, our data are for production purpose, they are not confidential. We are still ready to make this payment immediately, under the same conditions: Full decryption tool and assistance. If this offer is rejected, we will have no choice but to stop this discussion. Let us know if you are ready to proceed with this amount. We are still open, but this is the final effort on our side. You have the choice between 0$ or 50K$.
[Akira] — — Message 21/25
> $150,000 is our bottom line in your case.
[Akira] — — Message 22/25
> I can try to get approval to reduce by another 10-15k if you arrange payment this week.
[Victim] — — Message 23/25
> Thank you for the updated offer. This is really appreciated. We understand your effort to reduce the price, but unfortunately, even 135K$ is still far beyond our financial capacity as I already mentioned. Our final and only possible offer remains 50K$, which we can pay quickly. This is not emotional or strategic, it’s a financial and operational constraint. We can’t give you what we don’t have.
[Akira] — — Message 24/25
> That means that the incident will be announced soon.
[Akira] — — Message 25/25
> You can find your company name in our news column: [REDACTED URL]
If you want this post deleted, we must come to an agreement.