Hacker News Reader

> Surely, given the size of the demand, it is beyond the authority of TSMC to pay up, even _if_ they wanted to?

Think again. Companies try to hide it really well but million-dollar ransoms are paid all. The. Time.

Likewise with insurance payouts for kidnapping ransoms

A friend of a co-worker works for a contracting agency with services including incident response for data ransoms. He says their go-to tactic is to haggle with the ransomers to bring the ransom down to some fraction of what the customer paid them and then implying to the customer that they cracked the key.

Assuming the security consultant and the ransom gang are even distinct people at all. IT Sec is such an incredibly shady industry.

That's what Garmin ended up doing. The group had sanctions, so they had to pay a British company.

https://www.theverge.com/2020/8/4/21353842/garmin-ransomware...

Yes, though in the case I am most familiar with, making the payment was a big deal because the hackers were in a sanctioned nation, which makes sending payments there illegal. If I recall correctly they went through some intermediary but still made the ransom payment. Which goes against all of the annual import/export corpo training, but I guess they found a loophole.

Reply on news.ycombinator.com