A leak-site deadline does not describe every later use of a file. Our selected catalogue descriptions distinguish an unpriced release, a later repost and an advertised sale. A re-share dated August 2026 quotes a sale text from 2022; the listing can outlast the negotiation story attached to it.
These are edited descriptions of alleged failed talks; some combine posts or threads. Dates are first observations. They do not authenticate negotiations or support a paid/unpaid outcome rate.
- ReleasePublication without a stated sale price does not establish free or lasting accessSource: Edited catalogue descriptions; separate items, not one victim’s journey
- RepostOlder sale or release wording can circulate; repetition is not independent corroborationSource: Edited catalogue descriptions; separate items, not one victim’s journey
- Sale offerAn asking price describes an offer, not a completed transactionSource: Edited catalogue descriptions; separate items, not one victim’s journey
A Release Can Carry Its Own Sales Story
The edited catalogue describes: 'No deal, no response, no ransom paid', full data released
Advertised terms as catalogued: free.
The edited description combines a claimed release with the phrase “no deal, no response, no ransom paid”. That wording gives the publication a negotiation story, but does not authenticate either the break-in or the outcome. It may be copied by someone who did not conduct the original extortion.
The edited catalogue describes: Countdown timer expired, no deal, data uploaded
Advertised terms as catalogued: free.
The composite Everest-attributed item describes expired countdowns and publication. It combines releases and is not a single independently verified case. The release narrative does not authenticate an intrusion path or attack date.
Silence Is Used to Explain Publication
The edited catalogue describes: Seller says the clinic ignored the ransom demand, so the database is given away
Advertised terms as catalogued: free.
The edited catalogue describes: Poster says negotiations failed and publishes contact data
Advertised terms as catalogued: n/a.
These descriptions frame publication as a consequence of ignored demands or alleged failed talks. They show how a poster justifies release. They do not show that a particular victim refused, what files were accessible or whether a later paid offer concerns the same material.
A Later Listing Can Reuse an Older Negotiation Story
The edited catalogue describes: Seller says the victim did not negotiate, so the data goes on sale
Advertised terms as catalogued: $10,000.
The edited catalogue describes: Post says $5,500 was demanded, victim did not pay in time, data put up for sale
Advertised terms as catalogued: $5,500 demand quoted.
The 16 March item states a $10,000 asking amount for a database. The 21 August item describes a 2022 case and quotes a $5,500 demand. One is an asking price for material; the other is an alleged historical demand. They are different objects, and the amounts cannot establish what a ransom compares with what data fetched.
The 2022 reference inside the 2026 catalogue item is the useful observation: a negotiation story can continue circulating after its original period. It does not establish that the material is genuine, unchanged or newly stolen.
A Composite Item Is Not a Count of Releases
The edited catalogue describes: Repost template says the victim 'refused to pay the ransom' and the group released the data (large US consumer and finance companies)
Advertised terms as catalogued: n/a.
The catalogue groups several January-to-April threads under one ShinyHunters-attributed item. It records reused non-payment wording, not independently authenticated releases. The composite item does not establish an exact thread-to-event map. A repeated narrative can explain circulation without proving a fresh breach.
What One Crew Promised Its Partners Would Happen to Victims Who Do Not Pay
A released data set is only one of the consequences crews advertise to their own partners. Two partner notices we found go further. One, first seen on 1 February, sets a deadline: a target that has not entered the chat within two weeks gets an undated public entry. Our piece on ransomware negotiation as a service covers that notice.
The edited 14 January description announces a legal team preparing violation paperwork against victims who go silent or refuse payment, alongside call and mailing services. That is enough to show pressure being offered to partners. The description does not establish that the advertised pressure occurred.
The card matters because it tells a victim what the crew’s partners may threaten. Counsel and communications teams can prepare for it before the first call.
The same idea has a name in our glossary: double extortion, and its layered cousin triple extortion, where the pressure moves from the victim to its customers and regulators.
What This Evidence Cannot Tell You
The selected catalogue descriptions concern alleged failed talks. This selection contains no verified paid cases, so it cannot compare paid and unpaid outcomes or establish what payment buys. We cannot tell you how often a paid decryptor worked, whether data was deleted or whether paying victims were attacked again.
The US government has a clear view on that gap. In a September 2021 OFAC advisory, the US government says it “strongly discourages” paying ransom or extortion demands. It adds that “there is no guarantee that companies will regain access to their data or be free from further attacks themselves.”
The advisory also warns that facilitating a payment can violate sanctions rules, including for insurers and forensic firms. Liability can apply even if the payer did not know the recipient was sanctioned. Read the OFAC advisory on ransomware payments before any talk of payment. It is a US document, so ask counsel what applies in your country.
Should You Pay Ransomware? Seven Questions to Settle First
This is not legal advice, and the decision belongs to your leadership with counsel and law enforcement at the table. The questions below come from what the posts show plus the CISA #StopRansomware Guide. Answer them in order, before any contact with the crew.
- Can you restore without the key?Clean, tested backups can support recovery, but containment, system integrity, downtime and stolen-data exposure still need assessment. CISA advises checking for precursor malware before restoration.
- Does a decryptor already exist?CISA says to consult federal law enforcement about decryptors, because researchers have found encryption flaws in some ransomware families.
- Is the data really gone?Compare posted samples with your own logs. A claim is not a confirmed breach, and attacker write-ups can be wrong.
- What would silence buy, and can you check it?Nothing in our data lets a victim verify deletion. A composite catalogue item groups reused wording, and a separate 2026 item describes a 2022 case.
- Who must you tell before the deadline?CISA advises reporting to CISA, your local FBI field office, the FBI Internet Crime Complaint Center or the US Secret Service. OFAC treats prompt reporting as a significant mitigating factor. Add your insurer and counsel, and ask which breach-notice duties apply to you.
- Is any payment lawful for you?OFAC sanctions risk applies to payers and facilitators. Get counsel’s answer in writing before any step toward payment.
- What is your plan if the data appears anyway?Prepare customer notices, password resets and a statement now. Watch forums and leak sites for your name after the deadline, and prepare for possible wider pressure.
The order matters. Questions one to four tell you whether paying could change anything. Questions five to seven remain relevant whether or not payment is considered.
This sample cannot compare release outcomes after payment with outcomes after non-payment. Our ransomware response playbook and checklist turns the steps into a printable plan.
Brandefense follows leak-site claims through ransomware intelligence, and alerts you to a listing that names your organization. The glossary entry on ransomware-as-a-service explains the model behind the crews in these posts.
This piece is part of the Brandefense Cybercrime Report 2026. The ransomware chapter on 2026 leak-site claims holds the numbers behind the crews named here, and the report hub lists every chapter.
Evidence and Scope
This article uses the edited 60-item ransomware catalogue and the collected relay series for 1 January–27 October 2026. Catalogue dates are first-seen dates.
The selection is not a market census; programme descriptions, advertised terms and claims are different evidence units. The catalogue is an attributed account, not a fresh authentication of every original. October is partial and 22–28 July is sampled.
A claim is one canonical group–victim pair. The 9,203-claim series excludes 190 0APT claims and removes 171 spelling-variant duplicates. A repeated relay post is not independent confirmation. Asking terms do not establish payments, delivery or tested effectiveness.
AI-Assisted Preparation
Brandefense Research Team · Brandefense Blackhole data · Prepared by Claude Opus 5.5, checked by Codex Astra and approved by Brandefense analysts.
Why AI agents. Brandefense Blackhole, our cybercrime database, collects around 17 to 23 million dark web and Telegram posts a month. Reading that volume by hand, and linking a recruitment ad on one forum to a leak-site claim on another and a price list in a Telegram channel weeks later, is beyond what a human team can do alone.
Claude Opus 5.5 prepared the research: it searched the data, sorted and translated posts and drafted the text. Codex Astra then checked every number against the dataset files and tested each claim, and anything that did not hold was removed.
Brandefense analysts reviewed and approved the findings.
