Jurnal · Anton Kusnadi

Cybersecurity··7 min

Paying the Ransom: What You Are Actually Buying

A pair of antique brass balance scales on dark stone, the left pan empty and a single large iron key resting across the right.

Executive Summary

I have written before that ransomware is a board-level crisis rather than a technical one, and that the time to settle your position on paying is before you are under duress. What has changed since is the thing being sold.

What a Ransom Payment Used to Buy

The classical extortion transaction had one property that made it tractable: it was verifiable. The attacker encrypted your systems and offered a key. You could test the key on a sample. If it worked, it worked, and the question reduced to economics and law — is the ransom less than the outage, and are we permitted to pay this counterparty.

That framing produced the guidance most boards still hold. Keep immutable backups so you never need the key. Segment the network so the blast radius stays small. Consult counsel on sanctions exposure. Treat payment as a last resort. Every line of it addresses an attack that encrypts.

Extortion has moved on. When the attacker takes a copy and never encrypts anything, there is no key to test, because there is nothing locked. What is for sale is an assurance that the copy will be destroyed and never published — an assurance with no mechanism of verification behind it. You cannot audit a deletion you cannot observe, performed by a party whose business model depends on being untrustworthy, on infrastructure you will never see.

Two Governments, Two Refusals, Two Unrelated Outcomes

Berlin refused. On 5 September 2026, after the city declined a demand of 30 bitcoin, Rhysida published roughly 1.44 million files — pay stubs, scanned identity documents, civil servants’ home addresses, and material touching prisons, water treatment, and emergency power. Governing Mayor Kai Wegner’s position was correct and it protected nothing: “The State of Berlin will not give in to blackmail.”

Indonesia also refused, and got a completely different result for reasons that had nothing to do with refusing. When Brain Cipher encrypted the Pusat Data Nasional Sementara in June 2024, the demand was 8 million US dollars, around 131 billion rupiah. Two hundred and eighty-two government services stopped, immigration counters at Soekarno-Hatta among them. The government declined to pay. On 3 July 2024 the group released the decryption key at no charge, with a public apology, stating that it had decided independently and that no payment or law-enforcement pressure was involved.

That reads as refusal working. It is not. The attackers volunteered, and in the same statement they explained why the intrusion had been trivial: “the attack was so easy that it took us very little time to unload the data.”

Unload the data. The key restored availability. It said nothing whatsoever about the copy they had already taken, and no one has ever been able to confirm what became of it.

Indonesia’s outcome looked like a reprieve on the availability axis while the confidentiality question stayed permanently open — and the real failure had already occurred upstream, when BSSN confirmed on 27 June that PDNS 2 held no backup at all.

What the Payment Decision Can and Cannot Reach

In both cases the ransom decision was close to irrelevant to the outcome. Berlin’s files were published because they had already been taken; the refusal came too late to matter. Indonesia’s services returned because an attacker chose to hand over a key; the refusal had nothing to do with that choice either. In neither case did the decision at the negotiating table change the material facts.

What determined the outcomes was decided months or years earlier: how much sensitive material was retained, whether backups existed, how long an intruder could operate unnoticed, and whether anyone was watching data leave. This is the same argument as the one confidentiality makes against recovery planning, arriving from the other direction.

Pillar 1: Separate the Two Questions

Treat “can we restore operations” and “can we prevent publication” as entirely distinct decisions with distinct answers. Conflating them is how organisations end up paying for an outcome they were never going to receive.

  • Ask what specifically is encrypted, and whether a tested restore path exists
  • Ask separately what was copied, and accept that this question has no reliable answer
  • Never let a decryption need justify a payment whose real purpose is suppressing disclosure

Pillar 2: Price the Unverifiable Honestly

If the board is weighing a payment for deletion, the valuation must reflect what is actually being purchased: a criminal group’s word, unauditable, from an organisation that may be an affiliate operating under a brand it does not control.

  • Assume published-anyway as the base case — treat a quiet resolution as the exception that needs explaining
  • Document that assumption in the decision record, so the choice is made with open eyes
  • Recognise that payment may still be defensible for delay, but say so explicitly rather than calling it prevention

Pillar 3: Name the Authority Before the Countdown

Rhysida gave Berlin a deadline that expired on a Friday afternoon. Under a clock, an organisation without a named decision-maker will default to whoever is loudest.

  • Name, in advance, who decides and who may not be bypassed
  • Pre-clear the legal position on sanctions exposure and on whether payment is lawful for your entity
  • Agree the disclosure sequence — regulator, affected individuals, partners — before it is needed

Pillar 4: Move the Decision Upstream

Every control that reduces what an attacker can take also reduces what they can sell you back. Retention limits, egress monitoring, and privilege reduction change the ransom conversation more than any negotiating posture does.

  • Shrink the holdings; unheld data cannot be ransomed
  • Instrument outbound volume, so theft is detected while it is happening rather than afterwards
  • Rehearse the decision in a tabletop with the actual decision-makers in the room

The Mistakes I Keep Seeing

1. Treating “we do not negotiate” as a security control. It is an ethical and strategic position, and a defensible one. It is not a protection. Berlin held the line and lost 1.44 million files the same week.

2. Assuming a decryption key resolves the incident. It resolves the outage. The exfiltrated copy is a separate and longer-lived problem, and Indonesia’s case shows both facts can be true simultaneously.

3. Discovering the backup position during the incident. BSSN’s disclosure that PDNS 2 had no backup came a week into the crisis. If the payment debate is the first time anyone checks whether restoration is possible, the debate is already lost.

Questions Executives Are Asking

If refusing does not protect the data, why refuse?

Because the alternative does not protect it either, and payment adds funding of the next attack, sanctions exposure, and a documented willingness to pay that marks you as a repeat target. Refusal is the better position on every axis except hope. Take it for those reasons. It does not prevent publication.

Do attackers ever honour a deletion promise?

There is no mechanism by which you could know. Groups operate as affiliate franchises, data changes hands between operators, and a brand that disappears after an arrest takes its assurances with it. Absence of a published leak is not evidence of deletion; it is absence of evidence.

Should we buy cyber insurance that covers ransom payments?

Coverage is worth having for response costs, forensics, notification, and legal support, which are the expenses you will certainly incur. Be clear-eyed that a policy covering the payment itself does not make the deletion promise more reliable. It transfers the cost of an unverifiable purchase.

Does Indonesian law permit paying a ransom?

This needs your own counsel’s answer for your own entity, cleared in advance rather than during an incident, and it must account for sanctions exposure where the counterparty may be a designated group. The point of pre-clearing is that the legal question takes days and the attacker’s deadline does not.

Where This Leaves the Decision

The ransom question has not become easier. It has become less decisive. A board that spends its preparation time rehearsing the payment debate is optimising the least consequential moment in the entire incident, and it will arrive at that moment with its options already fixed by choices made years earlier.

The attack that opened Berlin’s network needed no vulnerability, and the losses that followed needed no negotiation.

So settle the posture, document who decides, and then stop rehearsing it. The negotiation is the shortest hour of the incident and the one you can influence least.