Ransomware gangs pretend to delete stolen data to extort victims twice, report warns
Security experts warn that paying ransomware hackers will likely lead to more demands


Ransomware gangs are reportedly sending victims fake evidence that stolen data has been deleted, only to use that data again in a second extortion attempt.
Notorious hacking groups such as Sodinokibi, Maze, and Netwalker have been tricking victims into a false sense of security, according to a Q3 Ransomware report from cyber security firm Coveware.
The report found that it has now become the default position for groups to hold onto data they have acquired, regardless of whether a ransomware payment has been paid by the victim. In fact, the cyber security firm found evidence that many groups are providing faked files that claim to prove that the data has been deleted.
Although some victims may decide there are valid reasons to pay, cyber security experts frequently advise against it. This is largely because there is no credible way to prove data has been deleted, or a way to ensure data has been returned, if that was the arrangement. There's also the potential that stolen data has already been traded, sold, or held by other threat actors for reuse.
Conti (aka Ryuk), which was recently revealed to be behind a third of all ransomware attacks in 2020 and is mentioned in the report, was recently blamed for an attack on French IT service Sopra Steria at the end of October. Although the company agreed to pay the ransom demanded by the hackers, it's now believed that the evidence provided to show deletion was in fact fabricated, according to Coveware.
RELATED RESOURCE
How to improve cyber security for remote working
13 recommendations for security from any location
"Unlike negotiating for a decryption key, negotiating for the suppression of stolen data has no finite end," the report stated. "Once a victim receives a decryption key, it can't be taken away and does not degrade with time. With stolen data, a threat actor can return for a second payment at any point in the future. The track records are too short and evidence that defaults are selectively occurring is already collecting."
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
Bobby Hellard is ITPro's Reviews Editor and has worked on CloudPro and ChannelPro since 2018. In his time at ITPro, Bobby has covered stories for all the major technology companies, such as Apple, Microsoft, Amazon and Facebook, and regularly attends industry-leading events such as AWS Re:Invent and Google Cloud Next.
Bobby mainly covers hardware reviews, but you will also recognize him as the face of many of our video reviews of laptops and smartphones.
-
The race is on for Higher Ed to adapt: Equity in hyflex learning
Hyflex courses can improve student wellbeing and engagement, but only with meeting technology that leaves no one behind
-
Gen Z workers are keen on AI in the workplace – but they’re still skeptical about the hype
News Younger workers could lead the shift to AI, but only think it can can manage some tasks
-
Ransomware victims are getting better at haggling with hackers
News While nearly half of companies paid a ransom to get their data back last year, victims are taking an increasingly hard line with hackers to strike fair deals.
-
LockBit data dump reveals a treasure trove of intel on the notorious hacker group
News An analysis of May's SQL database dump shows how much LockBit was really making
-
‘I take pleasure in thinking I can rid society of at least some of them’: A cyber vigilante is dumping information on notorious ransomware criminals – and security experts say police will be keeping close tabs
News An anonymous whistleblower has released large amounts of data allegedly linked to the ransomware gangs
-
It's been a bad week for ransomware operators
News A host of ransomware strains have been neutralized, servers seized, and key players indicted
-
Everything we know about the Peter Green Chilled cyber attack
News A ransomware attack on the chilled food distributor highlights the supply chain risks within the retail sector
-
Scattered Spider: Who are the alleged hackers behind the M&S cyber attack?
News The Scattered Spider group has been highly active in recent years
-
Ransomware attacks are rising — but quiet payouts could mean there's more than actually reported
News Ransomware attacks continue to climb, but they may be even higher than official figures show as companies choose to quietly pay to make such incidents go away.
-
Cleo attack victim list grows as Hertz confirms customer data stolen – and security experts say it won't be the last
News Hertz has confirmed it suffered a data breach as a result of the Cleo zero-day vulnerability in late 2024, with the car rental giant warning that customer data was stolen.