Dissent Doe  1d ago

When people keep advising victims not to pay ransom because threat actors can't be trusted to really delete all the data, my inner researcher kicks in and wants to know how often that really happens.

So I started sending out inquiries.

Now you might think that those who publicly and repeatedly urge journalists to "spread the word" not to pay would respond and share some of their experiences with untrustworthy threat actors, but no..... they didn't even respond.

Read about the replies I did get, because they really surprised me.

I have no doubt that some professionals will hate what I have reported, but then, perhaps they should have responded, too, if they think differently.

How often do threat actors default on promises to delete data?
https://databreaches.net/2026/04/05/how-often-do-threat-actors-default-on-promises-to-delete-data/

#databreach #incidentresponse #ransom

@zackwhittaker @campuscodi @euroinfosec @lawrenceabrams @jgreig @securityaffairs @Hackread @h4ckernews

Show threadSig. Ug.
@PogoWasRight @zackwhittaker @campuscodi @euroinfosec @lawrenceabrams @jgreig @securityaffairs @Hackread @h4ckernews For many attackers, managing large amounts of stolen data *clandestinely* is an annoying task they are glad to be rid of once they are paid. It is another part of their operations beyond the intrusion itself that they have to be very careful to manage in a way that cannot be attributed to them. Any remnant they keep is potential evidence against them if they should be apprehended in the future. The easiest and safest path is to get rid of it as soon as possible.
Apr 5 at 4:34pmWeb
Show threadJim Zhou5h ago
@sig_ug For reals, back when the source for one of the first RW was being passed around Alphabay forums (for testing... seriously, it's all logged) there were camps that simply wiped, period, and those who didn't. Short-term quick hitters v long term big payout models, I think. Wish there's data to see which one is more profitable on average, 10 years later.
My guess is that if you can properly ascertain data value, you can make $$$ and the breach won't ever be known. Skids HnR.