Hacker News Reader

Comment by IshKebab | Hacker News Reader

Wait they paid a ransom for the hackers to "delete" a copy of the data? That's insane.

They insist the hackers ‘verifiably’ deleted their copy of the data. I’d like to see how one verifies that ‘all’ copies were destroyed.

Asks for ransom to delete data

Press release goes out, saying the data was "deleted"

Send another ransom, maybe 5 BTC, otherwise data is released

Insert taps on head meme

Second time around, there is no real incentive to pay - fool me once etc etc

Imho it’s much better to just sit on it for a few months, then hit the usual forums to market it as high-quality data.

The incentive to pay is that it nukes Blackbaud's credibility and trustworthiness, and likely destroys the entire business.

To a criminal that's easily worth an ask of 5BTC - or perhaps x% of annual profits in perpetuity.

An extortion scam is likely to be worth more than the data.

Reputational damage happens anyway, once news of the first breach/ransom goes out (which it will, it’s increasingly mandated by law). Second time around they might as well fold.

A prolonged extortion scheme can only be done on a low-scale highly-targeted basis, where you can ensure word doesn’t get out.

If the hackers don't delete the data and use it for something else, nobody will ever pay them again.

Most cryptolockers and other random criminals do exactly what they promise because if they don't, their business model will collapse. All of the stolen info isn't worth nearly as much as what universities are willing to pay out if you keep your promises.

It's wicked, but these criminals do have a business incentive to be nice. Their next target will probably pay again if they act smart.

I wonder if a university could protect themselves from this form of attack by amending their bylaws (or some other similarly legally-binding-and-hard-to-amend policy) to say, "We will not pay any ransoms for X, Y, or Z", and then publicise that decision widely, so any potential criminals know that there's no money to be made in targeting them.

It might, unless the attackers see it as a challenge. Many types of cybersecurity insurance won't pay out if you don't or will be more expensive than paying out, so it also might be an expensive bet to take.

The problem is that smart criminals don't directly attack a single corporation or university, they'll attack a SAAS/IAAS/PAAS provider many of their potential targets use and see what they can get out of the data. In this instance even one university paying out would probably be enough to offset the risk and cost of the criminal operation.

In many cases, paying out is also the economical choice to take, especially in ransomware attacks. Even if backups were made, tested and recent, paying a million here and there might still be worth it if not doing so would cost weeks or even months of work and employees and students lacking IT services. With modern education being run like a business, I'm not sure if it'd even make sense to bet on such a statement to be worth it. You may shoot yourself in the foot when you eventually do get hit and you need to either spend lots of time and money or break the promise you made on your website (betraying your employees and students in the process by showing that you cannot hold up the values you claim to have).

Maybe so. In this case the breach occurred at a third party software vendor. You’d need to write a similar guarantee into any contracts you signed with vendors.

I still very much doubt they actually destroy the data though. They could easily be keeping everything and then once the ransomware stops paying as well, they'll start profiting from what they've stolen.

I don't see any incentive unless they have a brand name and do repeat business.

If a significant number of players defect, the scam as a whole would stop working.

Presumably all competent scammers benefit from being able to repeat the scam, and would lose out if the scam stopped working, so they all have an incentive not to defect.

Scams like this depend on the scammers understanding the incentives better than their targets and so it’s reasonable to assume that the scammers are aware of the context.

However - this is probably true as well:

https://news.ycombinator.com/item?id=23949046

Reply on news.ycombinator.com