LockBit Data Reveals Paying Ransoms Increases Public Exposure for Victims An analysis of seized LockBit ransomware data suggests that companies paying ransoms face greater negative publicity than those that refuse. Max Smeets, author of Ransom War, examined data from LockBit 3.0—obtained by the UK’s National Crime Agency (NCA) during Operation Chronos—alongside leaked LockBit 4.0 records. His findings challenge ransomware gangs’ claims that payment prevents exposure. Smeets compared media coverage of 100 companies that paid ransoms with 100 that refused, revealing that paying victims were more likely to be reported on. The phenomenon mirrors the Streisand effect, where efforts to suppress publicity backfire. Speaking at the Black Hat security conference in London, Smeets noted that law enforcement’s long-standing advice against payment—due to funding criminal operations and no guarantee of data recovery—now extends to reputational risks. The data also exposed poor negotiation tactics by victims. Some disclosed desperation, admitting to lacking backups, while others shared insurance documents or pleaded financial hardship—moves that weakened their position. LockBit affiliates follow a predictable playbook: demanding ransoms, offering token decryption tests, and threatening data leaks. However, Smeets found they rarely analyze stolen data for leverage, prioritizing volume over tailored extortion. If victims delay payment, affiliates may settle for smaller sums to avoid prolonged negotiations. The takedown of LockBit’s infrastructure in February 2024 provided a rare glimpse into ransomware operations, underscoring the need for better preparedness in handling extortion demands.