Travel Management Company Ended Up Paying $4.5M BTC Ransom

The travel management company CWTC ended up paying a $4.5 million bitcoin ransom to regain access to its computers. The ransomware hackers initially demanded $10 million to restore the computers and to delete the stolen data as we reported in the previous Bitcoin Scam news.

The US-based travel management company CWT paid the hackers a $4.5 million ransom and representatives explained that they paid 414 Bitcoins to the hackers which is $4.5 million at the time in two transactions. The blockchain data shows the criminals transferred the funds to a different address in less than an hour. The attackers said they used the Ragnar Locker ransomware to disable the access to files in more than 30,000 computers at the company and steal sensitive data. They initially demanded $10 million but accepted less than half of that as the representatives claimed the company suffered financial losses during the pandemic.

In an unusual show of the cordial negotiations considering the nature of the crime, the CWT representatives and one of the hackers discussed the price of restoring computer access in the accessible online chat group. The group stated such a ransom will probably be much cheaper than launching a lawsuit. In the chat, they offered a bonus of recommendations as to how the company could up their security game If they are willing to pay. According to the chart records, some of the ransomware group’s advice included changing passwords every month, having three system administrators, and checking up on the user privileges. After CWT paid the hackers, they ended the chat with “it’s a pleasure to work with professionals.”

Many businesses and organizations targeted by the ransomware groups ended up paying millions of dollars rather than risking sensitive information that was released or face the prospect of not being able to access the computer data for an extended period of time. The University of California at San Francisco School of Medicine paid $1.14 million ransom in crypto to the hackers in a ransomware attack on June 1.

The multinational tech company Garmin also got the decryptor to their files after a huge hack, suggesting the company could have paid all of the $10 million requested by hackers. Not everyone is interest to give in to demands of criminals as the unnamed English Football League club refused to pay the ransom to the hackers that targeted their corporate security systems.