lockbit3.0 — 0E1263992076698458ABCB025007C6FF
Date not recordedFrom extortion.wiki, the ransomware negotiation research archive
A validated static rendering of 42 messages in source-array order. Transcript text is preserved without editorial additions.
- Actor
- lockbit3.0
- Record date
- Date not recorded
- Messages
- 42
- Participants
- LockBit 3.0, Victim
Preserved messages
Actor / other Victim
Select a message number for a stable citation link. Text remains selectable; hard-wrapped source lines are joined for reading, intentional blank-line paragraph breaks remain, and written URLs remain inert.
-
Message 001 From Victim Victim Date [Chat started]
-
Message 002 From Victim Victim Date Bonjour, nous prenons sérieusement en compte votre attaque sur notre établissement. Qui êtes vous? et qu'est-ce que voulez vraiment à faire ce que vous faites?
-
Message 003 From LockBit 3.0 Actor / other Date Welcome. Your Servers have been encrypted by us. To decipher and restore the functionality of your network, you have to pay us $1,000,000 in Bitcoin. Additionally I inform you that we have about a million files from your servers concerning your patients. As well as contracts with partners and confidential agreements. Medical histories, doctor's appointments, prescriptions, ultrasound images, and personal data. In the event that you do not pay the ransom, this data will be published in our public blog. The amount of $ 1,000,000 is not big for your company. We did not put a high price, because we respect health care. We offer to solve everything quickly and without too much noise. You pay, we give you a decryptor and destroy your data from our servers
-
Message 004 From Victim Victim Date Savez-vous réellement qui vous avez attaqué? et les conséquences actuelles et futures que cela peut avoir pour nous, pour les personnes de notre établissement, pour vous? Nous vous demandons de nous donner maintenant les clefs de déchiffrement s'il vous plait et de stopper votre attaque inhumaine.
-
Message 005 From LockBit 3.0 Actor / other Date We know you're a commercial company. Which makes money. Your company's revenue is over seven hundred million dollars. You can stop the attack and be calm by paying just one million dollars. In case of refusal, we will take further pressure steps. We will contact your partners. Let's lay out some of the data about your patients. Info about covid vaccination. Covid passports. And the price can be increased.
-
Message 006 From Victim Victim Date Je suis surpris de voir que vous ne savez pas du tout qui nous sommes réellement! Nous sommes un hôpital public. Avec tout ce que cela entraîne comme pauvres moyens; financiers, matériels et en personnels. Je vous laisse en juger par vous-même avec les liens ci-dessous et je vous demande encore une fois de stopper votre attaque meurtrière s'il vous plait, en nous donnant maintenant les clefs de déchiffrement. Merci
-
Message 007 From Victim Victim Date https://twitter.com/BFMParis/status/1561970373314347008
-
Message 008 From Victim Victim Date https://twitter.com/CHSF91/status/1561762193980661760
-
Message 009 From Victim Victim Date https://www.reassurez-moi.fr/guide/mutuelle-sante/hopital-prive
-
Message 010 From LockBit 3.0 Actor / other Date https://www.zoominfo.com/c/centre-hospitalier-sud-francilien/426480031
-
Message 011 From LockBit 3.0 Actor / other Date You already losemore then 50ml revenue. You have only one way. Pay us fast to stop this. Or price can be increased.
-
Message 012 From LockBit 3.0 Actor / other Date We strongly advise you to complete your transaction with us as soon as possible. As soon as we receive payment we will immediately give you a decryptor. And the attack will be stopped. And the details of your partners and clients will not be made public. That's the only way. Nothing personal. Simple business.
-
Message 013 From Victim Victim Date Je pense que vous savez, avec ce que vous détenez et que vous comprenez que c'est impossible pour nous de payer la somme demandée. ET je ne comprends pas votre comportement, où sont donc passées vos valeurs? votre éthique?
-
Message 014 From Victim Victim Date https://medium.com/s2wblog/evolution-of-lockbit-to-3-0-e21386188b65
-
Message 015 From LockBit 3.0 Actor / other Date Je pense que vous savez, avec ce que vous détenez et que vous comprenez que c'est impossible pour nous de payer la somme demandée >>> Find the way to solve this problem. Every day you lose your money clients and reputation. That is why to solve this problem in your best interest je ne comprends pas votre comportement, où sont donc passées vos valeurs? votre éthique? >>>You get the money from your clients you do not anythink FREE! Now you face with our world reality. Next time pay attention your internet security
-
Message 016 From LockBit 3.0 Actor / other Date Since we do not yet see from you an adequate attitude to the situation and readiness to pay. We will begin to prepare letters for your clients and partners. And also we will begin to prepare a public blog for your company. We have a lot of your interesting date. Including also correspondence from mail servers. We give you time until 30.08 inclusive. In order to settle everything quickly and quietly. If by this time we don't start talking about payment. Then we will be forced to act further.
-
Message 017 From LockBit 3.0 Actor / other Date fr.jpg 0.97MB
-
Message 018 From LockBit 3.0 Actor / other Date Just look at this. Its only for u. For exemple.
-
Message 019 From Victim Victim Date Donc en résumé, si je comprends bien, tout ce que vous voulez c'est votre argent? Même si cela peut entraîner la mort de patients de notre établissement?
-
Message 020 From LockBit 3.0 Actor / other Date We know your situation no one of your pacient will not die, all what you want to restore your data and do not have data leak you have to pay money for this
-
Message 021 From LockBit 3.0 Actor / other Date Looking at our communication,we conclude that we are reaching a dead end. If we do not come to agreement to wensday we start making a public blog with your stolen data
-
Message 022 From Victim Victim Date Ok nous comprenons votre volonté et nous souhaitons coopérer pour que tout se passe bien pour nous. Nous avons essayé de vous transmettre des fichiers sur votre site mais ils sont trop lourd.
-
Message 023 From Victim Victim Date Votre attaque a directement atteint nos outils de virtualisations. Je ne peux pas vous envoyer de fichier. Les seuls fichiers que nous avons dépassent les 50 kb. Dans quelle mesure vous pouvez nous décrypter un fichier vmdk pour preuve que vous êtes en mesure de nous aider? De plus nous n'avons pas accès aux données de nos NAS.
-
Message 024 From Victim Victim Date https://transfert-my-files.com/files/?file=i-X7YvRvWLRmz
-
Message 025 From LockBit 3.0 Actor / other Date Welcome. To decrypt this file, we will need to wait for a technician. Decoding of small files is possible in automatic mode. Try to find a file of the desired size on your NAS. You should definitely have them there. After payment, you get a decryptor for all your files. Including your NAS and your virtual machines. We all want this case to end quickly and quietly. You can also find out information about us on the Internet. The companies we work with always get what they pay for.
-
Message 026 From LockBit 3.0 Actor / other Date https://tempsend.com/afgxk
-
Message 027 From LockBit 3.0 Actor / other Date Btw if you will not pay 1 000 000 usd till 30.08 the price will be 10 000 000 usd as in your public statement
-
Message 028 From LockBit 3.0 Actor / other Date bc1qwwym65pfw864lmt9e6v3f5hv08p4v4yqp49fsn you have to pay test payment to this btc adress
-
Message 029 From LockBit 3.0 Actor / other Date 1 $
-
Message 030 From Victim Victim Date Ok nous comprenons, nous souhaitons également que cela soit vite terminé. Nous vous remercions d'avoir compris notre situation et nous validons la transaction comme vous l'avez écrit ci-dessus pour 1$ et selon les modalités expliquées.
-
Message 031 From Victim Victim Date Bonjour. Le délai approchant, nous nous permettons de vous relancer pour savoir où nous en sommes de nos échanges?
-
Message 032 From LockBit 3.0 Actor / other Date Hello. Yes, your time comming to the end. Are you ready to pay?
-
Message 033 From LockBit 3.0 Actor / other Date We expect you to pay $1,000,000 in Bitcoin (49 BTC) to the address above. After payment, you will receive a decryptor for all your files and virtual machines. We will also delete all information about customers and partners stolen from you from our servers after payment. Right now you have to make a test payment 1$ after that you need write us.
-
Message 034 From LockBit 3.0 Actor / other Date bc1qwwym65pfw864lmt9e6v3f5hv08p4v4yqp49fsn
-
Message 035 From LockBit 3.0 Actor / other Date BTC adress
-
Message 036 From Victim Victim Date Bonjour, ok nous sommes d'accord pour tout cela. Cependant nous serions rassurés, n'ayant pas eu de vos nouvelles pendant plusieurs jours, si vous pouviez nous apporter la preuve de vos capacités à nous aider. Cela m'aiderait à convaincre ma direction pour procéder à la suite.
-
Message 037 From Victim Victim Date https://transfert-my-files.com/files/?file=i-9hESKh9AfKT
-
Message 038 From LockBit 3.0 Actor / other Date Ok, wait.
-
Message 039 From LockBit 3.0 Actor / other Date 1661980198_CHSFVW050-ctk.7z 1.02kB
-
Message 040 From LockBit 3.0 Actor / other Date Welcome. During this time, we did not see any test or main payment from you. We have provided you with all the evidence that we can and are ready to help you. You received the file. Talk to your boss. We need specific deadlines for receiving payments from you. In case you do not set us a deadline we will start making public blogs with your date. We will also continue to attack your clinic. It's all dragging on for too long. Our boss is not happy with this situation. If you do not solve it in the near future you will feel serious consequences.
-
Message 041 From LockBit 3.0 Actor / other Date http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion/post/CcZwzmJObnllfPLb631894526d239
-
Message 042 From LockBit 3.0 Actor / other Date Now this blog is available for viewing only for you! If you do not give an answer on the exact date of payment of the ransom, we will start mailing as well as calls to all partners, patients and employees, then the blog will become public.