zlacker

>>Strang+(OP)
If i was a customer id be pissed off, but this is as good as a response you can have to an incident like this.

- timely response

- initial disclosure by company and not third party

- actual expression of shame and remorse

- a decent explanation of target/scope

i could imagine being cyclical about the statement, but look at other companies who have gotten breached in the past. very few of them do well on all points

>>prodig+47
> as good as a response you can have to an incident like this.

From customer perspective “in an effort to reduce the likelihood of this data becoming widely available, we’ve paid the ransom” is probably better, even if some people will not like it.

Also to really be transparent it’d be good to post a detailed postmortem along with audit results detailing other problems they (most likely) discovered.

>>wallet+v8
Never pay the ransom.

The extortionist knows they cannot prove they destroyed the data, so they will eventually sell it anyway.

They will maybe hold off for a bit to prove their "reputation" or "legitimacy". Just don't pay.

>>rollca+Oa
If this is actually frequently happening, your claim should be pretty easy to prove. Most stolen databases are sold fairly publicly.

The ransom payments tend to be so big anyway that selling the data and associated reputational damage is most likely not worth the hassle.

Basic game theory shows that the best course of action for any ransomware group with multiple victims is to act honestly. You can never be sure, but the incentives are there and they’re pretty obvious.

The big groups are making in the neighbourhood of $billions, earning extra millions by sabotaging their main source of revenue seems ridiculous.

>>wallet+eb
> reputational damage

Whoa. You're a crime organization. The data may as well "leak" the same way it leaked out of your victim's "reputable" system.