// Context
About This Negotiation
This transcript documents a Qilin ransomware negotiation with a redacted victim organisation.
The negotiation consisted of 3 messages exchanged over Unknown.
The initial demand is not clearly stated in the transcript. The final outcome is not confirmed in the transcript.
// Primary Source
Full Transcript — Verbatim
Reproduced from Casualtek's Ransomchats archive. URLs have been redacted.
Victim names are shown only where the breach was publicly reported in mainstream media. Any organisation wishing their name redacted can contact us at
enquiries@binary-response.com — we will act promptly.
[Qilin] — — Message 1/3
Welcome . I would like to add that in addition to encrypting your network, we have also downloaded work data (documents, pdfs, sql databases, customer and staff data, etc.). We would like to warn you that in case you: keep silent, ignore our messages, we will notify your clients and staff about the leakage of personal and work data. We will also be looking for a buyer for your downloaded files it may be (competitors, media, tax authorities or simply put in the public domain...). we will publish them for everyone on our blog. This blog is followed daily by hundreds of media portals. If we agree with you, get a transcript program for your entire network (all files will be in original condition). All your files downloaded to our cloud disk will be completely destroyed (everything will remain confidential).
[Victim] — — Message 2/3
Hi. Can we get a list of the files that you downloaded?
[Qilin] — — Message 3/3
this is a partial listing of your files [REDACTED URL] you can choose 3 files from this list if they don't have serious working information on them. I will send them to you. You will get the full listing and its removal after we agree. You will also get a decryption program for your entire network.