The complete negotiation transcript — verbatim. 34 days. 103 messages. The demand that was never paid.
On 10 January 2023, LockBit 3.0 — then the world's most prolific ransomware group — successfully attacked Royal Mail's international distribution systems. The attack crippled Royal Mail International's ability to process overseas parcels and letters, causing immediate disruption to a service that handles millions of items daily.
Two days later, on 12 January, a Royal Mail representative connected to LockBit's encrypted negotiation portal on the dark web. What followed was one of the most extraordinary ransomware negotiations ever documented — 103 messages over 34 days, ending with a flat refusal and LockBit publishing both the stolen data and the entire transcript on 14 February 2023 — Valentine's Day.
LockBit's opening demand was $80 million — calculated as 0.5% of the parent company's annual revenue. But there was a critical error in their calculation: they had attacked Royal Mail International, a subsidiary of International Distribution Services (IDS), not the Royal Mail plc entity whose revenue figures they were using. Royal Mail International was, at the time, a loss-making subsidiary with significantly lower revenue than the parent group.
The Royal Mail negotiator exploited this distinction brilliantly, repeatedly explaining the corporate structure, citing publicly available financial reports showing losses, and framing the $80M demand as "absurd" relative to the actual entity that had been compromised. Meanwhile, the negotiator deployed a masterclass in delay tactics: citing board meetings over weekends, requesting decryptor verification for large files, raising questions about file integrity, and maintaining a tone that was simultaneously cooperative and immovable.
After 18 days, the board delivered its verdict through the negotiator: "Under no circumstances will we pay you the absurd amount of money you have demanded." The negotiations continued for another two weeks with LockBit reducing their ask, but Royal Mail had already made its decision. LockBit eventually published all stolen data and the full transcript, labelling Royal Mail as a failed negotiation and the negotiator as "a very clever negotiator" who needed to be replaced.
This case is widely considered one of the most successful non-payment negotiations in the public record. It demonstrated that even against the world's most aggressive ransomware group, a well-prepared negotiator with genuine arguments could refuse to pay — and survive.
What this transcript teaches every organisation about ransomware negotiation — whether you plan to pay or not.
Royal Mail brilliantly — and accurately — argued that LockBit had attacked Royal Mail International, not Royal Mail plc. The revenue figures LockBit was using were wrong. They'd calculated 0.5% of the parent company's revenue, which included UK domestic operations, GLS logistics in Europe, and other entities entirely unrelated to the compromised network.
This genuine distinction let the negotiator honestly push back on the $80M demand as completely disproportionate. When LockBit cited Wikipedia and TechCrunch articles about "Royal Mail," the negotiator calmly explained that Royal Mail International was a separate entity with its own Managing Director, its own financials, and crucially — its own losses.
The Royal Mail negotiator was masterful at buying time — without once making a false statement. Citing weekend board meetings that genuinely needed to happen. Requesting file verification that legitimately needed to be done. Raising concerns about large file decryption that were technically valid.
Every delay was framed as the negotiator trying their best to work with LockBit, but being constrained by internal processes. LockBit eventually recognised this, stating: "You are a very clever negotiator, I appreciate your experience in stalling and bamboozling." Even after this acknowledgment, the delays continued successfully.
The negotiator repeatedly positioned themselves as caught between LockBit and a board that was hard to persuade: "I am trying to help our Senior Team understand this." This is a classic negotiation technique — creating the impression of an internal advocate who wants to help but faces resistance from above.
By humanising their position, the negotiator made LockBit feel like they had an ally inside Royal Mail — someone who would bring their case to the board. In reality, this technique created an additional layer of abstraction between LockBit and the actual decision-makers, making it impossible for LockBit to apply direct pressure.
The question about whether the decryptor worked on large files — tied to a 6GB file associated with medical devices — was an excellent dual-purpose tactic. It served as both a legitimate due diligence requirement and a powerful stalling mechanism.
LockBit spent significant time addressing this concern, providing test decryptions, explaining their process, and even offering to re-encrypt and decrypt Royal Mail's own systems as proof. Each exchange added days to the timeline. The medical device angle also introduced a humanitarian dimension that made LockBit uncomfortable.
Royal Mail had clearly determined early that they were not going to pay £66M. The entire negotiation was time-buying. The board's final message — "Under no circumstances will we pay you the absurd amount of money you have demanded" — came 18 days into talks, but the decision was almost certainly made within the first few days.
Knowing the answer was "no" from the outset gave every subsequent move clarity and purpose. The negotiator wasn't trying to reach a settlement — they were maximising recovery time, gathering intelligence about the threat actor, and building a comprehensive understanding of what data had been stolen.
Published by LockBit 3.0 on 14 February 2023 after negotiations failed. The following is the complete transcript of 103 messages, reproduced verbatim from Casualtek's Ransomchats archive. URLs have been redacted.
LockBit published all stolen data on their leak site — on Valentine's Day. They also published the full negotiation transcript, adding commentary that Royal Mail needed "a new negotiator." The irony: publishing the transcript showcased exactly how skilled the negotiator actually was.
Royal Mail continued operations with limited international service for several weeks. The disruption was significant but manageable. Critically, no ransom was paid — confirmed publicly by Royal Mail and widely reported.
Royal Mail's negotiator was widely praised by cybersecurity experts. The transcript became required reading in incident response training programmes and was cited as a textbook example of how to handle a ransomware negotiation when payment is not an option.
Operation Cronos — a joint law enforcement operation led by the NCA, FBI, and Europol — took down LockBit's infrastructure, arrested key affiliates, and effectively ended the group's operations. Exactly one year after the Royal Mail transcript was published.
Royal Mail's negotiator performed excellently. But there are additional capabilities a specialist ransomware negotiation firm brings to every engagement:
LockBit's payment rate, average discount given, known bluffs, and historical behaviour patterns. Understanding whether a threat actor's deadline is genuine or theatrical changes the negotiation calculus entirely.
Ensuring any potential payment would not violate OFAC (US), OFSI (UK), or EU sanctions regulations. This is a legal requirement that many organisations overlook in the heat of an incident.
Assessing whether a payment could be tracked post-transaction and whether the receiving wallet has been flagged by law enforcement or exchanges.
A formal testing protocol rather than ad-hoc file testing — ensuring the decryptor works across file types, sizes, and operating systems before any payment decision is made.
Confirming, where possible, that published data was contained and assessing the realistic exposure from the data that was leaked.