Chemical distributor Brenntag paid a $4.4M ransom in bitcoin to the DarkSide ransomware gang, who claimed to have stolen more than 150 GB of sensitive data
Lawrence Abrams / BleepingComputer :
Context & Ripple Effects
Days after DarkSide forced Colonial Pipeline to halt operations over a stolen-and-encrypted ~100GB trove, BleepingComputer reports the same gang extracted a $4.4M bitcoin payment from chemical distributor Brenntag, claiming more than 150 GB of sensitive data as leverage. Brenntag is now the clearest documented example of DarkSide's double-extortion model converting directly into a paid ransom in this window.
First-order effects
- Brenntag is out $4.4M in bitcoin with no guarantee DarkSide deletes the claimed 150 GB of stolen data, and the payment confirms the gang's leverage tactics work on large industrial distributors.
Second-order effects
- As Krebs' deep dive on DarkSide's pressure playbook documents — affiliate phone calls, DDoS attacks, and threats to tip short sellers — victims face escalating coercion that pushes more firms toward paying rather than refusing, feeding the ransom pool that funds further attacks like the Colonial Pipeline operation.
Third-order effects
- The payment sits on a curve that later runs to records: the Cencora breach's $75M ransom in 2024 and the Dark Angels' ~$75M payment the same year show ransomware-as-a-service steadily raising the price of victimhood for distributors and industrial firms, with each confirmed payout validating higher demands for the next victim.
The trend: Double-extortion ransomware is industrializing: confirmed payouts to gangs like DarkSide keep scaling upward, making large data-rich distributors a recurring target class.