Sources: two US data recovery firms touting hi-tech solutions for unlocking data after ransomware attacks instead just paid the ransom and charged victims extra
Context & Ripple Effects
This ProPublica exposé is the opening move in a thread the outlet kept pulling: months later it reported that cyber insurers often prefer paying the ransom outright, even when backups could be recovered, because settling is cheaper than restoring. Together the two investigations show a response industry whose economics point toward payment rather than recovery.
The finding also predates the attackers' own adaptation: ransomware rings subsequently began stealing data before encrypting it, ensuring payment even from victims with clean backups — a shift that makes the intermediary layer exposed here more consequential, not less.
First-order effects
- Victims who hired the two firms paid the ransom plus a markup for a 'hi-tech' unlock they never received, meaning the firms' fees were pure margin on someone else's extortion.
- Both firms now face reputational damage and potential legal exposure over misrepresenting ransom payments as proprietary technical work.
Second-order effects
- Recovery firms and insurers function as de facto ransom-payment brokers, and their fee structures give them a financial incentive to pay rather than restore — reinforcing exactly the behavior the attackers price for.
- As intermediation normalizes payment, attackers' pivot to exfiltration-before-encryption directly targets victims who would otherwise rely on backups, raising the effective cost of every incident.
Third-order effects
- Ransomware response risks consolidating into a paid middleman economy — recovery vendors, insurers, and negotiators — with the tax code treating victim payments as deductible business costs unless an insurer pays, embedding extortion into ordinary accounting.
- Law enforcement is building the counterweight: the FBI's distribution of 7,000+ seized LockBit decryption keys shows a free-recovery channel that could disintermediate both the criminals and the fee-charging middle layer if scaled.
The trend: Ransomware is evolving from a direct criminal transaction into an intermediated market — insurers and recovery firms routing payments at a markup — while attackers adapt their leverage and law enforcement tries to cut out the middle.