[andmarios]

To be fair, once your data has been stolen, it doesn't make sense to engage with the hackers. There is no way to guarantee that the stolen data won't be used.

What you must do immediately is notify the affected customers, bring down or lock the affected services, and contact the authorities.

[poemxo]

I'm a customer and the first I'm hearing about this is from HN.

[eviks]

There is no guarantee anywhere (strictly speaking, including in the legal market), but that doesn't mean the paying has no effect of the probability of data being dumped. Notification is an independent requirement.

[jasonjayr]

There is an interesting dynamic/risk in play:

If an attacker make an extortion threat, but then still follows through on the release/damage after being paid, then people are not incentivized to engage with you, and will go into attack mode right away, making it riskier for you.

HOWEVER, if the attacker make the extortion threat, takes payment, and then honors the agreement, and ends the transaction, then parties are more inclined to just pay to make the problem go away. They know that the upfront price is the full cost of the problem.

I've seen that there are 'ethical attackers' out there that move on after an attack, but you never know what kind you're dealing with :-/ "Never negotiate...."

[Loudergood]

Then the hacker org spins up a new name(like a shitty construction llc) and robs the next guy.

Reputation isn't all that useful for extortion.

Running all your crimes as the "Wet Bandits" makes it much easier for law enforcement if they do catch up with you.

[themafia]

There's no way to guarantee that I won't get in a car accident. So I pay for insurance. I may never need it, it may never come in handy, but it still makes sense to carry the policy.