Twenty-five Thousand Dollars, and More Than Half of Them Paid

Researchers who worked through the negotiation records report demands clustering in the tens of thousands of dollars — figures such as $50,000, $60,000 and $100,000, and in some cases a few thousand — across around 208 identified conversations.

One affiliate’s activity was described in detail: fourteen victims, demands between roughly $25,000 and $120,000, and payment in about 57 per cent of cases.

The Black Basta chats showed demands priced against looked-up victim revenue, with a largest reported demand of $28.7m. Here the demands are two to three orders of magnitude smaller and appear to be priced at what a small organisation might actually pay.

The open question filed at 25-0226 was whether other operations price the same way. On this evidence: no, and not remotely. Whatever else the two leaks establish, they close the possibility of a general theory of ransom pricing built from either one.

Fifty-seven per cent, over fourteen victims. The sample is far too small to carry a sector-wide claim and this desk is not making one — at 25-0922b the corpus refused a pattern claim built on two incidents, and fourteen is not fourteen thousand.

What it does is establish an existence proof. Somewhere in this market there is an operator for whom most demands are met, and the demand is set low enough that meeting it is the cheap option.

A $28.7m demand generates a board meeting, a law firm, an insurer and eventually a public record. A $40,000 demand generates a wire transfer and nothing else.

The corpus argued at 25-0613b that every filter selecting incidents into the public record selects for large organisations. Demand size is another such filter, operating on the victim’s side: below some threshold, paying quietly is rational and disclosure is optional.

That threshold is where this database stops being able to see anything, and the panel dump suggests a great deal of the activity sits below it.