If You Pay a Hacker's Ransom, Chances Are They'll Come Back for More
A new Proofpoint survey reveals that over a third of companies that paid a ransomware demand were subsequently hit with a second extortion request.
A survey conducted by cybersecurity firm Proofpoint, which included 953 companies, found that more than one-third of those that paid a hacker's ransom later received a second extortion demand. This data confirms what has long been known—there is no incentive for extortionists to stop after a single payment.
Ransomware and extortion tactics have evolved from a one-time transaction into a multi-leverage effort, where hackers retain stolen data and threaten to leak it. Despite hackers' promises to delete data after payment, past incidents show otherwise.
Last month, a hack at market research firm Klue exposed customer data, including several cybersecurity firms. The company reached a deal with the hackers, who claimed to have deleted the data, but later a separate hacking group swiped a sample, leaving customers vulnerable to further extortion.
A similar situation occurred in 2024 with Change Healthcare, when a Russian-speaking ransomware gang stole health data of 192 million Americans. Amid a dispute between the hackers and their affiliates, Change Healthcare paid separate ransoms to both criminal groups to keep the data off the internet.
Security researchers have long suspected that ransomware gangs retain stolen data even after payment. In 2024, UK law enforcement confirmed this during the takedown of the LockBit ransomware gang, finding victims' data on LockBit servers long after ransoms had been paid.
