On 1 March 2024 a payment of about $22 million in bitcoin moved to an address associated with ALPHV. The parent company later confirmed it had paid, and its chief executive said publicly that the decision was his.
Almost every ransom in this database is a demand rather than a transaction. Payments are inferred from chain analysis, admitted under regulatory pressure, or never established at all. This one is on the record from the party that made it.
What The Payment Was For
Two things at once, which is the standard double-extortion shape: a decryptor to restore systems, and suppression of the stolen data. The corpus notes at 25-0215 that the second undertaking has no enforcement mechanism and no value.
The file at 24-0405 records what that meant here. The data was extorted a second time, by a different group, using the same copy.
Confirmed Payments Are Rare And Therefore Load-Bearing
This corpus has argued repeatedly that payment rates are unmeasurable — the panel dump at 25-0519 gave one affiliate’s figure over fourteen victims and nothing more general. Confirmed large payments are rarer still.
The reason is straightforward. Disclosing a payment invites regulatory attention, shareholder litigation and a reputation for paying, and almost nothing compels it. A company that pays quietly and says nothing has taken the cheaper path, which is why the sample of known payments is not a sample of payments.
The Decision Is Defensible And The Outcome Was Still Bad
A payment made to restore claims processing for a large part of a national health system is not the same decision as one made to protect a quarterly result, and this desk is not going to treat it as one.
It nonetheless bought neither of the things it was for. That is the finding, and it is a finding about the mechanism rather than about the judgement of the people who authorised it.
Compiled from contemporaneous reporting of the payment and of the company’s subsequent public confirmation, listed below. Graded high: the payment is confirmed by the payer. The exact figure is reported as approximately $22 million and is not treated as precise. Corrections: corrections@forensicpost.com.