// Context
About This Negotiation
This transcript documents a lockbit3.0 ransomware negotiation with Bakker Heftrucks.
The negotiation consisted of 27 messages exchanged over 2 days, beginning on 2022-09-12.
The initial ransom demand was Unknown. The final outcome is not confirmed in the transcript.
// Primary Source
Full Transcript — Verbatim
Reproduced from Casualtek's Ransomchats archive. URLs have been redacted.
Victim names are shown only where the breach was publicly reported in mainstream media. Any organisation wishing their name redacted can contact us at
enquiries@binary-response.com — we will act promptly.
[Bakker Heftrucks] — 12.09.2022 09:54:30 UTC — Message 1/27
[Chat started]
[Bakker Heftrucks] — 12.09.2022 10:03:45 UTC — Message 2/27
Hallo, I would like to decrypt a file
[Bakker Heftrucks] — 12.09.2022 10:08:50 UTC — Message 3/27
We would like to get back our files etc. Our personal ID is 0384F759C4124EF970C8201B0AE06EBD. What are you're instructions to get our data back ?
[lockbit3.0] — 12.09.2022 10:57:55 UTC — Message 4/27
Hello, the price for your whole network is 100k USD.
[lockbit3.0] — 12.09.2022 11:02:05 UTC — Message 5/27
We have steal, malbox.edb and all your users files, If you don t pay we will public them, take in consideration we don t have what to do with them..
[lockbit3.0] — 12.09.2022 12:22:28 UTC — Message 6/27
The file you tried to decrypted is too big, try with a smaller file. I recomand a .jpg
[Bakker Heftrucks] — 12.09.2022 12:44:02 UTC — Message 7/27
Hello, I consulted this number and this is not a realistic offer. We have backup and are able to restore, this is going to take some time and money. We are willing to pay 5k.
[lockbit3.0] — 12.09.2022 12:45:31 UTC — Message 8/27
If you have backup, why are u here? I deleted ur nas myself, ur altaro saved locally not cloud
[Bakker Heftrucks] — 12.09.2022 12:46:06 UTC — Message 9/27
We have older backup files on external devices
[lockbit3.0] — 12.09.2022 12:46:54 UTC — Message 10/27
Come with a better offer than 5k
[Bakker Heftrucks] — 12.09.2022 12:46:55 UTC — Message 11/27
So we are here because it's going to take time to restore those and enter the missing data
[lockbit3.0] — 12.09.2022 12:48:22 UTC — Message 12/27
Come with a better offer. 5k i will not accept it.
[Bakker Heftrucks] — 12.09.2022 12:49:21 UTC — Message 13/27
I have to consult but I think they won't accept anything higher
[lockbit3.0] — 12.09.2022 12:49:43 UTC — Message 14/27
You are from the it company ?
[lockbit3.0] — 12.09.2022 12:52:43 UTC — Message 15/27
They hired you to speak with us? or what ?
[Bakker Heftrucks] — 12.09.2022 12:53:30 UTC — Message 16/27
yes we are
[Bakker Heftrucks] — 12.09.2022 12:56:04 UTC — Message 17/27
I consulted with the customer and they can pay 6k, this is maximum, they cant pay more.
[lockbit3.0] — 12.09.2022 12:57:19 UTC — Message 18/27
As we said, no midleman.. because in the past they fuckedup our negotians.
[lockbit3.0] — 12.09.2022 12:58:12 UTC — Message 19/27
6 k not gonna happen.
[Bakker Heftrucks] — 12.09.2022 12:59:20 UTC — Message 20/27
give us a normal number than
[lockbit3.0] — 12.09.2022 13:00:19 UTC — Message 21/27
Normal ? 95k usd
[Bakker Heftrucks] — 12.09.2022 13:05:03 UTC — Message 22/27
Final offer: 10k or we will begin restoring the backup that is offsite. You can respond till 15:30 CEST
[lockbit3.0] — 12.09.2022 13:08:03 UTC — Message 23/27
The lowest we can go, 60k, have a good day.
[Bakker Heftrucks] — 12.09.2022 13:09:46 UTC — Message 24/27
good luck men
[lockbit3.0] — 12.09.2022 13:11:35 UTC — Message 25/27
ty
[lockbit3.0] — 12.09.2022 18:43:13 UTC — Message 26/27
We accept 15k euro! last and final price.
[lockbit3.0] — 14.09.2022 11:10:54 UTC — Message 27/27
10k"