Live data from Hacker News

Royal Mail dismisses ‘absurd’ $80M ransom demand

theguardian.com

71–80 of 108 posts

Re: Royal Mail dismisses ‘absurd’ $80M ransom demand

#71

It's fucking ridiculous to hit the postal service, providing a practically-free function to a lot of people who really need it, and operating at barely even (in US and Canada too, so I imagine other countries are similar). The ransomers sound like kids, "speculating that the directors personally held 100m of crypto"? What a disgusting amateur job.

Royal Mail is a private company, it was sold by the UK government for about £3b 10 years ago. It's now worth about £2b.

Re: Royal Mail dismisses ‘absurd’ $80M ransom demand

#72
post #11

How is it even legal to pay ransoms? Surely this is transferring money to criminal enterprises. If it is not illegal it needs to be made illegal.

That's weird. It's like saying it should be illegal to give your wallet to a mugger.

It is not very similar I think — in a mugging the “don’t pay” downside is violence, possible death. In a ransomware situation, the victim is basically making an economic decision — is the cost of losing their files greater than the cost of the ransom.

The cost of dying is basically infinite, the cost of paying the ransom can be shifted up and down with fines until it is high enough to disincentivize paying.

Re: Royal Mail dismisses ‘absurd’ $80M ransom demand

#73

Earlier quoted context omitted.

If paying ransoms become illegal in many countries, it would be very hard to find targets willing to break the law and pay ransom, making it less attractive of an attack.

Surely it would still depend on the normal economic calculations of the involved parties, like the penalty for paying a random, the likelihood of getting caught paying a ransom, and all the existing calculations like the value of the data to the victim, the penalty and risk of getting caught for the ransomers themselves, etc. You don't just get to say "making it illegal will destroy the incentive to do it," and if it…

This is true. It is a financial decision. The costs options are:

* pay enough in IT to run an up to date, secure system

* pay enough in ransom to get your files

* eat the cost of losing your files

Adding a possible fine to the middle one means the cost of the top and bottom ones can be higher. Either non-paying option makes the business of running ransomware schemes less viable.

Re: Royal Mail dismisses ‘absurd’ $80M ransom demand

#74

I bought some candy from Amazon that was shipped by Royal Mail, and it never arrived. Amazon told me to take up the refund with Royal Mail, with no instructions how to do so. Anyone know how I can get a refund from Amazon/Royal Mail for the candy they never sent?

Anecdotal, but I've just heard someone getting refused to be refunded because instead of a phone, the return carrier delivered a bunch of batteries. Now the end client is without a product, and without money, with basically no recourse. Probably best to document the whole return process, that's just the world we live in right now.

Re: Royal Mail dismisses ‘absurd’ $80M ransom demand

#75
post #44

Why is ransomware still a problem? Is it that difficult to make off-site backups every hour? Storage is cheap. There are many air gapping options for backups, too. It sounds like a case of normalized deviance, for which the management should be held accountable. As much as I don’t like victim blaming, I think it’s beyond incompetent to still not backup your data in 2023 as a government org.

Many ransoms now are for the leaking of the info, not the destruction of the info.

With huge GDPR fines for data leaks in Europe, the criminals are using the legal system as their 'threat'.

Re: Royal Mail dismisses ‘absurd’ $80M ransom demand

#76

Earlier quoted context omitted.

> If Russia were to physically disrupt a country's social services by force, it would be an act of war If the Russian STATE did this yes. But we don't generally consider the act of citizens/organizations/criminal enterprises within a state as a state action unless it's clearly state sponsored. You definitely could make that argument, but it's not a given. For example, we don't consider the 3000 British people fightin…

I have no doubt that the Russian government has been taking its cut from criminals deploying ransomware in their country, and only going after criminals who don't provide their share. Even more so with Russia trying to fund an ongoing war where they are losing a lot of equipment and men.

Its so crazy to say something like "i have no doubt" about something you don't seem to have any experience or expertise in

Re: Royal Mail dismisses ‘absurd’ $80M ransom demand

#77

It's fucking ridiculous to hit the postal service, providing a practically-free function to a lot of people who really need it, and operating at barely even (in US and Canada too, so I imagine other countries are similar). The ransomers sound like kids, "speculating that the directors personally held 100m of crypto"? What a disgusting amateur job.

It's also f-ing ridiculous they were so irresponsible as to not protect their computers. F** these ransomers for the terrorist they are!

Re: Royal Mail dismisses ‘absurd’ $80M ransom demand

#78
post #36

I bought some candy from Amazon that was shipped by Royal Mail, and it never arrived. Amazon told me to take up the refund with Royal Mail, with no instructions how to do so. Anyone know how I can get a refund from Amazon/Royal Mail for the candy they never sent?

It’s not your problem. The seller is legally responsible for the delivery. Chat with Amazon again and remind them. Or consult with Citizens Advice if you need help. Amazon support eventually refunds basically anything if you are persistent enough.

Maybe, but in one specific occasion I know of, the client was told not to contact support anymore for a refund. I think it's a different retail landscape now to what it was in 2020-2022.

Re: Royal Mail dismisses ‘absurd’ $80M ransom demand

#80

It's fucking ridiculous to hit the postal service, providing a practically-free function to a lot of people who really need it, and operating at barely even (in US and Canada too, so I imagine other countries are similar). The ransomers sound like kids, "speculating that the directors personally held 100m of crypto"? What a disgusting amateur job.

To all those naysayers that claim there is no present use for "cryptocurrency", we present "use of crypto for untraceable ransom payments". One could almost imagine regulating crypto for public policy reasons.
Post reply on HN