Royal Mail refused to pay £66m LockBit ransom demand, logs reveal

Lengthy negotiation

The logs appear to show that Royal Mail first made contact with the ransomware gang on 12 January, and was able to obtain proof of some data theft, a process that appears to have been dragged out to 21 January, two days after the postal service was able to implement some technical workarounds that bypassed the encrypted systems and enabled it to resume parts of its operations.

The negotiator told LockBit that some of the files encrypted pertained to the shipment of lifesaving medical equipment, but LockBit refused this request, stating that Royal Mail was making multi-billion dollar profits – this is not true – and was being greedy and trying to get something for nothing.

They also told Royal Mail that the ransom demand was substantially less than the maximum regulatory fines it could face from the UK authorities over a data breach.

“We are all suffering from the global crisis and our income has fallen as much as yours … you are hundreds of times richer than us,” said LockBit’s representative.

Ransomware negotiation

The full log, which has now been obtained and reviewed by Computer Weekly, reads as a fairly standard ransomware negotiation in which the cyber criminal representative presents their extortion racket as something akin to a legitimate business service, such as an organisation might procure from a genuine cyber security company.

The logs also reveal some insight into how ransomware victims are advised to go about conducting a negotiation.

Throughout the process, the supposed Royal Mail negotiator understandably plays for time with a formulaic approach to their answers, advising that they need to communicate various offers to the board, which generally needs a couple of days or a weekend to meet and come to a decision that never seems to arrive.

At times they seem to present themselves as a low-level technical employee who is trying to make their senior leadership understand the scale of the problem.

All of these tactics have a clear effect on proceedings, drawing them out and giving the postal service a fighting chance to mount a more effective response.

Why now?

Tim Mitchell, a security researcher at Secureworks, who as the organisation’s thematic lead for LockBit has been tracking the ransomware cartel for some time, shared some insight into why the group may have chosen to go public. 

“When LockBit moves to publish the negotiation conversation it usually happens after the fact, when they have written off any chance of getting paid, to serve as a deterrent to future victims,” he said. “The message being: ‘if you don’t pay, we can publish files and share this data, too’. But such a tactic can also leave the door open for further negotiations.

“Twice now, we’ve seen LockBit issue deadlines for publishing data, and no files have been released other than this negotiation conversation. The chat still suggests they have data – so the questions remain what data do they have and why haven’t they released it? With Royal Mail systems still not up to full operational capacity for international package, what is the ongoing cost to the business?”

Mitchell also noted that the scale of the ransomware demand, one of the highest ever seen, was “vastly unrealistic” on LockBit’s part.