5.3: Ransom Decisions

Ransom Decisions

Start with the three stories, because together they kill the idea that there’s a universally right answer.

Colonial Pipeline, May 2021. DarkSide ransomware hit the IT network; leadership shut the pipeline — 45% of East Coast fuel — and paid roughly $4.4 million within a day to get a decryptor. The decryptor was so slow they largely restored from backups anyway. A month later, the DOJ clawed back about $2.3 million of the Bitcoin. Payment bought them almost nothing operationally; the outage and the political fallout happened regardless.

MGM Resorts, September 2023. Scattered Spider social-engineered the help desk, ALPHV ransomware followed. MGM refused to pay. The cost of that refusal was public and brutal: roughly ten days of casino-floor chaos — slot machines dark, hotel keys dead, check-in by clipboard — and about $100 million in quantified impact. But it ended, cleanly, with no ongoing relationship with the crew and no payment to disclose.

Caesars Entertainment, three weeks earlier, same crew. Caesars paid — reportedly around $15 million negotiated down from $30 million — before the story broke, and disclosed in an SEC filing that it had taken steps to ensure the stolen data was deleted, with the memorable caveat that it could not guarantee this. Caesars kept operating. It also bought, at best, a promise from professional extortionists.

Same threat actor, opposite calls, and both companies are fine today. The lesson isn’t “pay” or “don’t pay.” It’s that this is a business decision with a specific structure, and your job is to run the structure rather than have an emotion.

The structure

1. Can we restore without them? This is the question that decides most cases, and it was decided months before the incident — by whether your backups (lesson 1.4) are intact, offline-protected, and tested. If restore works, payment buys you nothing but speed, and (per Colonial) maybe not even that. If restore doesn’t work, you’re negotiating from your knees. Every dollar of backup testing is leverage purchased in advance.

2. What are we actually buying? Encryption-only: a decryptor of unknown quality. Data theft (now the common case, often with no encryption at all): a promise to delete from a criminal enterprise — unverifiable by construction. Paying to prevent publication is buying a pinky promise; price that honestly in the decision.

3. Are we legally allowed to pay? OFAC’s guidance is blunt: payments to sanctioned entities or jurisdictions can violate sanctions law on a strict-liability basis — you’re exposed even if you didn’t know. Attribution is genuinely murky; crews rebrand across sanctioned and unsanctioned identities. This is why the sanctions screen, run by specialists through counsel, precedes any payment conversation — and why a payment broker’s “we guarantee OFAC compliance” is a phrase to walk away from. Nobody can guarantee that; the liability stays yours. Self-reporting and law-enforcement cooperation are explicit mitigating factors in OFAC’s framework — one more reason the FBI call happens early.

4. Who decides, and is it written down? A payment of this size and consequence is a board-level decision, informed by counsel, insurer, and your negotiation specialists — documented in the decision log with alternatives considered. Not because bureaucracy is a virtue, but because “reasonable decision on the information available” is a defense, and an undocumented seven-figure payment to criminals is a very hard story to tell later.

About negotiation

One nuance the headlines miss: opening a channel is not paying. Professional negotiators talk to crews to buy time, verify the data claims, test whether the “proof pack” is real, and establish price — all while restore proceeds in parallel. Refusing to pay and refusing to communicate are separate decisions. The first is often right; the second usually just costs you information.

The calm-day version

Decide your defaults now, in a paragraph your board has seen: our posture is that we do not expect to pay; we maintain tested restores to make that true; if payment is ever considered it requires sanctions clearance, insurer consent, and board sign-off. A crew’s 72-hour countdown timer is designed to make you improvise. The counter to a countdown is a policy that predates it.