Telecoms giant T-Mobile tried to pay hackers to limit the spread of stolen data, according to unsealed court documents.
However, the move backfired as the assailants went on to leak the information more widely, Vice reports.
T-Mobile confirmed that it had been breached last year, with hackers threatening to sell the personal data of 30 million customers for six bitcoin - said to be worth around $270,000 at the time. However, on Tuesday, an indictment unsealed by the Department of Justice revealed that the tech giant had employed a third-party firm that paid the hackers $200,000 for exclusive access to the stolen data so that it could prevent any further leaks.
The indictment was against Diofo Santos Coelho, who is alleged to have administrated the popular hacking site 'RaidForums'. He was arrested in the UK in March and extradited to the US to stand trial over a particular set of data found on RaidForums. In August 2021, an individual using the moniker "SubVirt" had posted an offer to sell data stolen from an organisation simply listed as "Company 3". Another post on the site confirms that the data belongs to a "major telecommunications company" that operates in the US.
The document goes on to say that the unnamed company "hired a third-party" to act as a buyer and purchase exclusive access to the databases to prevent them from being sold to "criminals". An employee of the third party is said to have used RaidForums' 'middleman service', which is operated by the administrator, to buy a sample of the data for $50,000 worth of bitcoin. It is claimed that the same employee then purchased the entire database for around $150,000, with a request that SubVirt would then delete their copy. However, it appears that the hackers continued to try and sell the database after the third-parties purchase, according to the court documents.
This is one of several reasons victim companies are discouraged from paying ransom demands to hackers. Third parties are often brought in to investigate breaches and advise on the best courses of action. Some may offer controversial services, such as revenge hacking, but it is generally held that paying ransom demands doesn't work.
In the UK, around 82% of businesses infected with ransomware ended up paying in 2021, according to research from Proofpoint.
-
Using DeepSeek at work is like ‘printing out and handing over your confidential information’News Thinking of using DeepSeek at work? Think again. Cybersecurity experts have warned you're putting your enterprise at huge risk.
-
Can cyber group takedowns last?ITPro Podcast Threat groups can recover from website takeovers or rebrand for new activity – but each successful sting provides researchers with valuable data
-
Average ransom payment doubles in a single quarterNews Targeted social engineering and data exfiltration have become the biggest tactics as three major ransomware groups dominate
-
BlackSuit ransomware gang taken down in latest law enforcement sting – but members have already formed a new groupNews The notorious gang has seen its servers taken down and bitcoin seized, but may have morphed into a new group called Chaos
-
Google cyber researchers were tracking the ShinyHunters group’s Salesforce attacks – then realized they’d also fallen victimNews In an update to an investigation on the ShinyHunters group, Google revealed it had also been affected
-
Nearly one-third of ransomware victims are hit multiple times, even after paying hackersNews Many ransomware victims are being hit more than once, largely thanks to fragmented security tactics
-
75% of UK business leaders are willing to risk criminal penalties to pay ransomsNews A ransom payment ban is a great idea - until you're the one being targeted...
-
The Scattered Spider ransomware group is infiltrating Slack and Microsoft Teams to target vulnerable employeesNews The group is using new ransomware variants and new social engineering techniques - including sneaking into corporate teleconferences
-
Hackers breached a 158 year old company by guessing an employee password – experts say it’s a ‘pertinent reminder’ of the devastating impact of cyber crimeNews A Panorama documentary exposed hackers' techniques and talked to the teams trying to tackle them
-
The ransomware boom shows no signs of letting up – and these groups are causing the most chaos
News Thousands of ransomware cases have already been posted on the dark web this year
