extortion.wiki THE RANSOMWARE DOCUMENTARY ARCHIVE
Menu

242 negotiations · 332 notes · snapshots Jul 06, 2026 / Jun 26, 2026

BlackMatter — 20210829

Dated record

From extortion.wiki, the ransomware negotiation research archive

A validated static rendering of 44 messages in source-array order. Transcript text is preserved without editorial additions.

Actor
BlackMatter
Record date
Aug 29, 2021
Messages
44
Participants
BlackMatter, Victim

Preserved messages

Actor / other Victim

Select a message number for a stable citation link. Text remains selectable; hard-wrapped source lines are joined for reading, intentional blank-line paragraph breaks remain, and written URLs remain inert.

  1. Message 001 From Victim Victim Date

    hi

  2. Message 002 From BlackMatter Actor / other Date

    Hello

  3. Message 003 From Victim Victim Date

    Looks like our files encrypted by you, can you please assist?

  4. Message 004 From BlackMatter Actor / other Date

    Oh sure

  5. Message 005 From BlackMatter Actor / other Date

    What can I help you with?

  6. Message 006 From Victim Victim Date

    we're here to negotiate, our management wants to make sure that you have our data if we are to pay, can you provide some proof of the data, sample data etc.?

  7. Message 007 From Victim Victim Date

    Please let us know if we can obtain some proof data. Thanks.

  8. Message 008 From BlackMatter Actor / other Date

    Have you received files? Do you need more?

  9. Message 009 From BlackMatter Actor / other Date

    If so let us know, we wil prepare more data for download

  10. Message 010 From Victim Victim Date

    No we have not received the files, please send or let us know where to download the proof data. Also, we would like to see files in our buffalo backups since those systems were formatted we would like to make sure those files are available too. Thanks for working with us!

  11. Message 011 From BlackMatter Actor / other Date

    All backups was securely deleted to prevent you from recovery process. Everything else was encrypted, we will prepare archive with stolen data in 30 mins, stay in touch.

  12. Message 012 From BlackMatter Actor / other Date

    https://privatlab.org/s/v/[redacted]

  13. Message 013 From BlackMatter Actor / other Date

    There is little sample with clients info autocad drawings and so on, check it out

  14. Message 014 From BlackMatter Actor / other Date

    https://privatlab.org/s/v/[redacted]

  15. Message 015 From BlackMatter Actor / other Date

    Its filee tree

  16. Message 016 From Victim Victim Date

    Thank you! I will send these to our management for review.

  17. Message 017 From Victim Victim Date

    They asked if you could provide proof of some of the files below:

  18. Message 018 From Victim Victim Date

    \\vhost2\data\v[redacted]\v[redacted]\virtual machines\   A few files from this folder. 192.168.0.31\data\sqldata\db[redacted]_eng.mdf 192.168.0.31\data\sqldata\[redacted].mdf

  19. Message 019 From Victim Victim Date

    Also, while we're reviewing the files, is it possible that the timer can be stopped as we're working on the funds? Thank you so much!

  20. Message 020 From BlackMatter Actor / other Date

    We cannot share files like you asking for because it is database files, and one of them is database of backup software. Timer updated.

  21. Message 021 From Victim Victim Date

    Thank you. Does that mean you don't obtain those.mdt requested above, and cannot provide them after payment, we would need to use the decryptor to decrypt them, correct?

  22. Message 022 From BlackMatter Actor / other Date

    You're right. Usually we directly download files instead of download whole VM.

  23. Message 023 From BlackMatter Actor / other Date

    Hello, any news?

  24. Message 024 From Victim Victim Date

    Hi. We checked the portal a couple of days ago and this chat portal was down, I couldn't get in to chat with you. I made a request via "Contact Us" button, (Request ID: [redacted] for your reference.) And we had a long holiday weekend. Can you extend the timer again due to the portal being down?

  25. Message 025 From Victim Victim Date

    Also, our management wants to make sure, once the payment is make: 1) you will provide us the data back through download, 2) you will delete our data from your side and provide proof, 3) you will provide us the decryptor, with support if there is any question or issue with the decryptor), 4) you will tell us how you hacked our network, 5) you will not publish the data or the blog post / any media that you hacked our network and data. We were just able to test the decryption too now that the portal is back up. Please confirm and I will let my management know. Thank you!

  26. Message 026 From BlackMatter Actor / other Date

    First of all we add 3more days in timer. 1. We will setup temporary onion website where you can download your files to understand which ones was downloaded. 2. We will provide shreder log-files with reports of deleted files so you will compare it with files ha you download. 3. Support for decryption available 24/7/365, but don't have any cases where it was needed. 4. Short penetration-test report with main killchain and recommendations how to prevent this in future. 5. Data in blog published only when we lost contact, so dont worry about it.

  27. Message 027 From Victim Victim Date

    Perfect. Thank you for the confirmation!

  28. Message 028 From Victim Victim Date

    Our management had a meeting today and they would like to ask if you will take $150,000. We know this amount is small compared to your initial demand, but please understand that we sell [redacted] to school and government, and as you know, since covid started, all school has closed or gone online so no one has been buying our [redacted], therefore we have been suffering as many other business. Also, looking at your main page, where you mention that you do not attack government sector, if we work with school and government like that, do we qualify for the free decryptor? Just thought we'd check. Again, thank you for working with this. Please let us know if any of these works for you.

  29. Message 029 From BlackMatter Actor / other Date

    Hello. You do not fall under our rules, it will not work for free. Maybe you mean 150k discount? We know your cash flow and amount what we're asking for is not overpriced.

  30. Message 030 From Victim Victim Date

    Thanks for verifying that we do not fall under your rules. Please understand that we are a small company and do not have significant capital, and we are here to negotiate in good faith. Our management would like to know the amount that you can come down off the initial demand. Thank you.

  31. Message 031 From BlackMatter Actor / other Date

    We can provide 20% discount and reduce 20% boost if you want to pay in bitcoin. So our best offer ~4-4.5M

  32. Message 032 From BlackMatter Actor / other Date

    You're not so small how you want

  33. Message 033 From BlackMatter Actor / other Date

    [picture]

  34. Message 034 From Victim Victim Date

    Hi. the bank statement isn't actually telling much, we have expenses that the bank statement doesn't show, and a lot of those money in the statement are not ours, they're on-hold funds from other entities. If we were to pay 4M based on that bank statement, we would be out of business. Our management came back with $250,000, which is the most that they can get at this point. Please understand and help us out.

  35. Message 035 From BlackMatter Actor / other Date

    Its too low, take a loan or smth because your offers is awful. We better lost amount that you offers than take this. We dont care.

  36. Message 036 From Victim Victim Date

    Can you please give us more discount? Really covid and everything have been hitting us hard. We really appreciate your help, anything we can get.

  37. Message 037 From BlackMatter Actor / other Date

    Sure we can but its about 250k in total.

  38. Message 038 From Victim Victim Date

    Sorry I didn't get that...

  39. Message 039 From BlackMatter Actor / other Date

    Lets try to safe your and our time. We setting price for 2.5M$ for 72h. There is enough time to take decision. If you will stuck in exchange or something we will add more time.

  40. Message 040 From BlackMatter Actor / other Date

    Price and timer updated. Tell to you manager that he must think twice, lost encrypted data and publish whole company secrets versus 2.5M$.

  41. Message 041 From Victim Victim Date

    Hi. Our management has gone to the board and this is a huge number for them, they can try to squeeze out $350K now, please help work with us here and see if this is acceptable. Thanks for your help!

  42. Message 042 From BlackMatter Actor / other Date

    its too low. we will not accept this amount, dont try this, safe your time

  43. Message 043 From Victim Victim Date

    We've been going out to get loans from the banks and able to get $500K total. We can pay within the next 24 hours if you accept this amount. Please let us know. Thank you!

  44. Message 044 From BlackMatter Actor / other Date

    Its still too low. Get 1M more and we will make a deal with highest discount in history.