Hacker News Reader

China sure isn't going to advertise buying a copy.

also, governments like china, North Korea , Russia, Iran are basically silent endpoints for this stuff, so assuming it's valuable data, the ransom request should trigger whatever intelligence protocols you have.

The 'when' can be important too, because the sensitivity and value of data generally goes down over time.

> It's still impossible to prove the files were deleted even if they don't release after the initial payment

Often the data isn't exfiltrated at all, only encrypted in place, which should be relatively easy to prove.