// Context
About This Negotiation
This transcript documents a Conti ransomware negotiation with a redacted victim organisation.
The negotiation consisted of 13 messages exchanged over Unknown.
The initial ransom demand was $4.0M. The negotiation resulted in a confirmed payment.
// Primary Source
Full Transcript — Verbatim
Reproduced from Casualtek's Ransomchats archive. URLs have been redacted.
Victim names are shown only where the breach was publicly reported in mainstream media. Any organisation wishing their name redacted can contact us at
enquiries@binary-response.com — we will act promptly.
[Conti] — 4/28/2021, 2:17:12 PM — Message 1/13
Hello, are you ready to negotiate?
[Victim] — 5/21/2021, 8:14:23 PM — Message 2/13
negotiate, really?
[Conti] — 5/22/2021, 11:26:03 AM — Message 3/13
That is totally real.
[Conti] — 5/24/2021, 7:09:43 PM — Message 4/13
If we will not receive the reply from your side we will start contacting all of your clients and employees to notify them about the breach and on how you mantain privacy and information security and on how you value their data.
[Victim] — 5/25/2021, 12:54:05 PM — Message 5/13
please don't. lets talk what you got and what you need, shall we?
[Conti] — 5/25/2021, 1:23:01 PM — Message 6/13
The demand for the decryption tool and removing the stolen data from our servers is $4mil. If you do not need the tool and are already recovered - let me know and we will provide a solid discount. The datapack example and parts of the file listing will be provided later today.
[Conti] — 5/25/2021, 2:11:00 PM — Message 7/13
[redacted]_full_listing.txt [ 5.3MB ]
[Conti] — 5/25/2021, 2:11:17 PM — Message 8/13
example_datapack.rar [ 689kB ]
[Conti] — 5/25/2021, 5:14:43 PM — Message 9/13
You can choose any 2 files from the listing, we will discard them as proof that the files were really stolen.
You can also send 2 files for a free decrypt.
[Conti] — 5/25/2021, 10:43:22 PM — Message 10/13
And you better do it. Asap.
[Conti] — 5/26/2021, 2:15:20 PM — Message 11/13
Any update?
[Conti] — 5/27/2021, 8:58:09 AM — Message 12/13
We need your reply tomorrow, otherwise we shall start actions.
[Conti] — 5/31/2021, 9:57:35 AM — Message 13/13
Ok, you've made your choice. Now we will have to make sure that we have your attention.