If you pay a hacker's ransom, chances are that they'll come back for more | TechCrunch
SearchSubmit
Site Search Toggle
Mega Menu Toggle
Topics
Latest
AI
Amazon
Apps
Biotech & Health
Climate
Cloud Computing
Commerce
Crypto
Enterprise
EVs
Fintech
Fundraising
Gadgets
Gaming
Government & Policy
Hardware
Layoffs
Media & Entertainment
Meta
Microsoft
Privacy
Robotics
Security
Social
Space
Startups
TikTok
Transportation
Venture
More from TechCrunch
Staff
Events
Startup Battlefield
StrictlyVC
Newsletters
Podcasts
Videos
Partner Content
TechCrunch Brand Studio
Crunchboard
Contact Us
Image Credits: Donat Sorokin / Getty Images
Security
If you pay a hacker’s ransom, chances are that they’ll come back for more
Zack Whittaker
8:29 AM PDT · July 22, 2026
Governments have long warned not to pay a hacker’s ransom demands, arguing that doing so only lets criminals profit from their cyberattacks and funds the next one. There’s also another reason: The hackers are unlikely to leave you alone if you pay up once, and many will come back demanding more.
In a report published Wednesday, cybersecurity giant Proofpoint said it surveyed 953 companies and found that over one-third of companies that paid a hacker’s ransom were hit with a second extortion demand. The findings underscore the long-held understanding among security researchers and network defenders that it’s impossible to negotiate in good faith with an extortion racket because there’s no incentive for the other side to actually walk away.
Proofpoint’s data shows that ransomware attacks and extortion attacks have evolved from a single transaction where hackers would get paid once and move on, into an effort using multiple forms of leverage, such as retaining stolen data under the threat of publicly releasing it.
While hackers have claimed in the past that they will delete or destroy the victim’s stolen data, past incidents have shown that not to be the case.
Last month, a hack at market research firm Klue exposed data belonging to its customers, including several cybersecurity firms. The company said it struck a deal with the hackers, who claimed to have deleted the data, but the company later conceded that a separate hacking group swiped a sample of the company’s stolen data, leaving its customers exposed to potential future extortion demands.
A similar situation befell Change Healthcare in 2024, after a Russian-speaking ransomware gang stole the health and medical data of the majority of people in America, some 192 million people. Amid a dispute between the hackers and their affiliates (criminal groups often subcontract out attacks), Change Healthcare paid separate ransoms to both groups of criminals to keep the sensitive medical data off of the internet.
Security researchers have long suspected that ransomware gangs and extortion rackets will keep hold of the victim’s stolen data, even after a payment is made. U.K. law enforcement confirmed this during their takedown efforts targeting the prolific LockBit ransomware gang in 2024. Police said that they found victims’ stolen data stored on LockBit’s servers long after they had paid the ransom.
Topics
cyberattack, ransomware, Security
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.
Zack Whittaker
Security Editor
Zack Whittaker is the security editor at TechCrunch. He also authors the weekly cybersecurity newsletter, this week in security.
He can be reached via encrypted message at zackwhittaker.1337 on Signal. You can also contact him by email, or to verify outreach, at zack.whittaker@techcrunch.com.
View Bio
October 13 – 15
San Francisco
Scale faster. Grow your portfolio. Gain practical expertise. No matter your goal, Disrupt can empower you.
Save up to $330 toda y!
REGISTER NOW
Most Popular
Jack Dorsey is taking on Slack with Buzz, a group chat platform for teams and their AI agents
Amanda Silberling
Light made a flip phone — it’s colorful and it’s cheap
Amanda Silberling
AI music generator Suno breach affects 55M users, per Have I Been Pwned
Zack Whittaker
Anthropic’s landmark $1.5B copyright settlement is approved
Kirsten Korosec
Google is working on a new AI chip designed to make Gemini more efficient
Lucas Ropek
Judge pauses $110B Paramount-Warner Bros. merger
Aisha Malik
Coca-Cola suspended production at its Fairlife dairy after a ransomware attack
Zack Whittaker
Loading the next article
Error loading the next article
© 2026 TechCrunch Media LLC.