// Context
About This Negotiation
This transcript documents a lockbit3.0 ransomware negotiation with Porcelanosa USA.
The negotiation consisted of 8 messages exchanged over 3 days, beginning on 2022-08-12.
The initial ransom demand was $1.5M. The final outcome is not confirmed in the transcript.
// Primary Source
Full Transcript — Verbatim
Reproduced from Casualtek's Ransomchats archive. URLs have been redacted.
Victim names are shown only where the breach was publicly reported in mainstream media. Any organisation wishing their name redacted can contact us at
enquiries@binary-response.com — we will act promptly.
[Porcelanosa USA] — 12.08.2022 21:42:54 UTC — Message 1/8
[Chat started]
[Porcelanosa USA] — 12.08.2022 21:44:03 UTC — Message 2/8
what do you want?
[lockbit3.0] — 12.08.2022 21:44:45 UTC — Message 3/8
Hi
[lockbit3.0] — 12.08.2022 21:45:46 UTC — Message 4/8
The price of the decryptor and deletion of your data is $1,500,000 in bitcoins. 275gb of data was stolen. At the moment we haven't published your name to the blog to keep the attack secret, but if you don't pay we will fix it! We know who you are and how much you earn.
[Porcelanosa USA] — 12.08.2022 21:46:26 UTC — Message 5/8
i dony have access to such amout of cash sir
[lockbit3.0] — 12.08.2022 21:50:30 UTC — Message 6/8
It doesn't concern us. Solve the problem within the company! Call the main office in Spain. Soon we will send you a tree of stolen data
[lockbit3.0] — 12.08.2022 21:55:09 UTC — Message 7/8
[REDACTED URL]
[lockbit3.0] — 15.08.2022 12:19:11 UTC — Message 8/8
Have you looked at the data tree? When will you pay?