Extortion & Ransomware Negotiations
Empirical case records of ransomware extortion demands, corporate negotiations, cryptocurrency payments, and subsequent law enforcement asset recoveries.
Key Facts
- Empirical analysis of documented ransomware extortion demands, negotiation transcripts, and cryptocurrency flows.
- OFAC sanctions strictly prohibit facilitating payments to Specially Designated Nationals (SDNs) without federal license.
- U.S. Department of Justice precedents establish that concealing extortion payments as bug bounties is a federal crime.
- Law enforcement increasingly executes civil asset forfeitures and private key seizures to recover Bitcoin ransoms.
Change Healthcare / UnitedHealth Group
Paid: $22,000,000 Paid (March 2024)After receiving the $22M payment, ALPHV core operators executed an exit scam, stealing the entire ransom from affiliate Notchy and faking an FBI seizure banner. The affiliate then re-extorted Change Healthcare with remaining stolen records.
High risk of secondary enforcement; ALPHV leaders subjected to $10M State Dept bounties.
Caesars Entertainment
Paid: $15,000,000 Negotiated SettlementPaid $15M to suppress leak of 65M loyalty customer database records. Extortion payment was subsequently disclosed in SEC Form 8-K filings.
Scattered Spider composed primarily of Western English-speaking adolescents, avoiding traditional Russian OFAC SDN designation.
Colonial Pipeline Company
Paid: $4,400,000 Paid (75 BTC on May 8, 2021)The FBI seized control of the threat actor Bitcoin wallet private keys, successfully recovering 63.7 BTC ($2.3M at time of seizure) within weeks.
Spurred OFAC updated advisory warning that facilitation payments to sanctioned ransomware variants risk strict civil liability under IEEPA.
Uber Technologies, Inc.
Paid: $100,000 Paid via HackerOne Bug BountyUber security leadership funneled extortion payment through third-party bug bounty platform as a faux bug bounty, requiring hackers to sign non-disclosure agreements falsely stating no data was downloaded.
Led to federal criminal conviction of Uber Chief Information Security Officer Joseph Sullivan for obstruction of justice and misprision of a felony.
CNA Financial Corporation
Paid: $40,000,000 Paid (One of the largest in history)Negotiations conducted through specialized third-party firm to navigate strict OFAC sanctions barring transactions with designated Russian entity Evil Corp (Maksim Yakubets).
Strict OFAC review required to ensure Phoenix Locker was not formally attributed to designated entity Evil Corp before facilitating transfer.