It's a sort of prisoner's dilemma problem - since the game won't be repeated with any single employee, and there's no communication between employees, the gang gets a better outcome in all cases by not paying.
I'd bet on the employee getting scammed too.
You don't even have to time it perfectly. In six months, when they're most upset and seeking revenge they'll remember the email
Ugh feels so dirty even saying it, I guess that's why sociopaths win so often.
"we paid this other guy and he got caught"
"come join us!"
For me it's not hard to believe at all that someone who is already at a low point and motivated with malicious intent would read up on such an offer and think to themselves "I can screw my boss __and__ get a cool million in etc? Just for 'accidentally' uploading some ssh keys with a misplaced wildcard?"
Even before the covid pandemic, stress in IT was high and disgruntled employees doing damage on the way out was making headlines. Search 'Disgruntled employee destroys data' on google and check the date of some of the news articles. Here's one that made US national news in 2014 about how data theft was a trend.[0]
Whether or not there's a real payout is of no consequence it seems. I'm only able to immediately find articles about such incidents in the US and the UK, but I am fairly sure it's not limited to such locations, or that outsourced IT isn't just as vulnerable.
I've written it before on HN for other reasons, but people like to talk about new laws/standards/etc, but IT doesn't have problems that need legal solutions, as an industry, IT needs to improve discipline across the board and stop letting situations where one person can be so destructive happen. Too many places still run their IT like it's the 80's/90's where one or maybe two with absolutely control over everything. This leads to burnout first of all, which is horrible, but it also creates these bad situations of unregulated control in the first place.
[0] https://www.wsj.com/articles/fbi-warns-of-rise-in-disgruntle...
I mean, it's like having the neurosurgeon at the hospital retire/quit for a software company to lose it's IT.
The issue is, many software companies don't know/think they are a software company.
Many companies that get hacked get hacked again anyway. With the help of an insider, an attacker could more effectively around any new countermeasures, too.
https://www.zdnet.com/article/lightning-does-strikes-twice-i...