'This is a sales tactic': Experts warn ransomware hackers will often lower their prices - with some giving discounts up to 96%

Date:
Mon, 25 May 2026 18:24:43 +0000

Description:
Ransomware actors use a whole range of different tactics to persuade victims to pay the demands.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter NordStellar finds many ransomware negotiations go unpaid, usually at steep discounts (median 57%,
max 96.2%) Attackers used varied tactics: bundling services, offering fake security audits, proof of data, press threats, GDPR violations, and price manipulation Leaking stolen files remained the dominant pressure tactic (76.8%), but deadlines were often bluffs designed to push victims into paying While threatening to leak stolen data is still the most effective negotiation strategy in ransomware attacks, its not the only one, as new research from NordStellar has found cybercriminals employ a whole range of tactics, from significant discounts, to providing security audits and reports to the victims.

The company recently analyzed 246 leaked conversations between ransomware groups and victim companies that took place between 2020 and 2026. A quarter (25.6%) ended up paying, but the vast majority of those did not pay the
asking price. The median discount in those payments was 57%, while the
highest recorded discount was 96.2%. Latest Videos From You may like Ransomware payments drop to record low, even as attacks surge Big Game Hunters: UK ransomware volume drops significantly 'but the reality is more alarming' big orgs are being hit harder and with greater success Rival ransomware gangs battle as one group threatens to expose another Bundled services, upselling, and more The report found crooks often start their negotiation with a sales tactic - respond quickly, and the price drops 25-67% immediately. Stall, and the price rises.

Then, they will split their services: decrypting the files being one and deleting the stolen documents the other. In around 16% of cases, the
attackers offered victims all services included bundle packages, while in
21%, they tried to sell these services separately.

Even though the promise of data deletion appears often, theres no way for companies to actually verify deletion, said Mantas Sabeckis, a senior threat intelligence researcher at Nord Security.

Id advise companies to tread carefully and take these statements with a huge grain of salt ransomware actors are skilled manipulators. Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get
all the top news, opinion, features and guidance your business needs to succeed! Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting
your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.

Funnily enough, in 7.3% of the conversations, the attackers offered their victims a security audit/report, as if they were cybersecurity professionals, not lowly criminals.

Threatening to leak the stolen files is by far the most common tactic, used
in 76.8% of all analyzed conversations. Other common tactics include
providing proof of data (55.3%), special price offers (45.5%) or threatening to go to the press (43.5%). NordStellar has also seen threats of GDPR compliance violations (17.9%) and threats of increasing prices (7.3%).

Its important to note that the attackers deadline is almost never real. They want the money they wont walk away on the first day, Sabeckis concluded. The best antivirus for all budgets Our top picks, based on real-world testing and comparisons

Read our full guide to the best antivirus 1. Best overall: Bitdefender Total Security 2. Best for families: Norton 360 with LifeLock 3. Best for mobile: McAfee Mobile Security Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.



======================================================================
Link to news story: https://www.techradar.com/pro/security/this-is-a-sales-tactic-experts-warn-ran somware-hackers-will-often-lower-their-prices-with-some-giving-discounts-up-to -96-percent


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)