// Context
About This Negotiation
This transcript documents a Hunters International ransomware negotiation with a redacted victim organisation.
The negotiation consisted of 29 messages exchanged over Unknown.
The initial ransom demand was $10.0M. The victim refused to pay.
// Primary Source
Full Transcript — Verbatim
Reproduced from Casualtek's Ransomchats archive. URLs have been redacted.
Victim names are shown only where the breach was publicly reported in mainstream media. Any organisation wishing their name redacted can contact us at
enquiries@binary-response.com — we will act promptly.
[Hunters International] — Saturday, 19:40 — Message 1/29
Hi, how may I assist you?
[Victim] — 19:46 — Message 2/29
That is an extremely high demand. To consider any payment we need to know what you have and what you did. It looks like I can upload encrypted files to test your decryptor?
[Hunters International] — 19:47 — Message 3/29
Yes, you can. We will decrypt. The data will be available later.
[Victim] — 19:52 — Message 4/29
Thank you
[Victim] — 21:14 — Message 5/29
Do you know how much data you have?
[Victim] — Sunday, 3:58 — Message 6/29
I think you provided a file listing? Looks like just 2.7 million files? Just want to be sure I have the right number to report
[Hunters International] — 5:04 — Message 7/29
That is correct. We have 2,793,643 files 2.3 TB in total.
[Victim] — 13:34 — Message 8/29
Ok that's good to know. It's not everything but it is a lot. We are analyzing it now and will have a request for a few files so you can prove you have them and not just a file tree. I also have a team working on getting encrypted files. This has proved difficult so please be patient
[Hunters International] — 13:57 — Message 9/29
Okay.
[Victim] — 15:52 — Message 10/29
Files uploaded for proof of decryptor
[Hunters International] — 16:11 — Message 11/29
The files have been decrypted.
[Victim] — 16:14 — Message 12/29
Thank you. Updating
[Victim] — 18:26 — Message 13/29
My executives want me to make you aware that we have been through this before. We were ransomwared a few years ago, and similar to you they asked for a ridiculous amount of money. We did not pay them. Their loss puts you at an advantage though. We did buy Bitcoin then for the potential situation we are in right now. My boss does not want to waste money or time on this any longer and is willing to pay you that Bitcoin so we can all walk away today. As you know banks are closed today and tomorrow due to holiday, so we only have what Bitcoin we have to work with. We can send you $1,500,000 within hours. Accept and we will start the process of cold storage removal
[Victim] — Monday, 0:28 — Message 14/29
We have a majority of the Bitcoin ready. Did you take today off for easter? The longer this takes the less valuable payment becomes
[Hunters International] — — Message 15/29
We are ready to take nothing if it's what you meant. The price is final. It is only your decision to pay or be disclosed.
[Hunters International] — 4:19 — Message 16/29
We do discounts only for small companies.
[Victim] — 14:32 — Message 17/29
In the last ransomware case we walked away from a lower demand. You currently can have $1.5 million ready to be in your hands. Our bank is closed so we can only work with the bitcoin we have from the last incident, which is less than your demand. Additionally if this goes much longer, my executives may change their mind and just rebuild. Please make a reasonable offer
[Hunters International] — — Message 18/29
We are not in a hurry. We will wait for your bank to be opened.
[Hunters International] — 14:51 — Message 19/29
And please stop appealing to your last ransomware case. We are not them and each case is unique, especially when you are dealing with us.
[Victim] — — Message 20/29
We appreciate your patience but we will not be paying $10 million. The longer this goes on the more likely you get nothing. You don't have everything and our rebuilding teams are being activated. Please provide a reasonable offer and I will push to get approved.
[Victim] — 15:49 — Message 21/29
It is good for you to know our experience so you can make an educated decision to work together to come to a reasonable conclusion. Our executives have walked away before. We are prepared to pay you a great deal of money for quick resolution but not as much as you are asking
[Hunters International] — — Message 22/29
I'm okay to get nothing. Just tell me that you will not pay us $10M and I will publish all of your data on our data leak site right away.
[Hunters International] — 19:32 — Message 23/29
I also would like to point you out that we will send a bulk email to your competitors, partners and customers, informing them about the incident with proofs attached.
[Victim] — 21:51 — Message 24/29
Let’s reset and try to work together on this. Clearly $1.5mm is not enough and $10 is too high. How do we come up with something in between? I think everyone wants to move quickly to finish this on good terms
[Hunters International] — Tuesday, 5:18 — Message 25/29
The only way for you to resolve this is to pay the full amount.
[Victim] — 14:36 — Message 26/29
Our IT team is rebuilding and having success. Soon there is no need to continue this conversation. We will not pay you $10mm. We are willing to resolve this today for $4,000,000.
[Hunters International] — — Message 27/29
Okay, so you are ready for your data will be published?
[Hunters International] — — Message 28/29
We don't need $4M or even $9M. Stop wasting your time.
[Hunters International] — 14:44 — Message 29/29
I hope you already checked our data leak site so you can see there are some huge companies with all sensitive data published. You are not an exception.