Most ransomware cases we take never reach a payment. Before anyone speaks to a threat actor, our recovery team works the problem directly, and settlement only enters the conversation when every other path is genuinely closed.
Our incident response team is on the phone within the hour, walks your people through what is actually happening, and tells you plainly what your options are, including the ones that cost no ransom at all. Real engineers, working alongside your team, until the incident is closed.
24/7 emergency line
Recovery time is rarely set by how much data was encrypted. It is set by whether your Active Directory and backup infrastructure survive in a state you can trust, and whether enough evidence survives to prove the intrusion is actually over. Both of those are usually decided in the first sixty minutes, and the two mistakes that turn days into weeks are self-inflicted.
Sever network connectivity at the switch ports, the VLANs, and the VPN concentrator. Do not power systems off. Encryption keys and recoverable artifacts frequently sit in memory, and a shutdown throws them away. In the same motion, confirm your crown jewels are out of the attacker's reach.
Under-isolation is the single most expensive error we see. Teams triage host by host while the attacker is still live, re-encryption hits the systems they just restored, and the entire job gets done twice. The second time, nobody trusts anything.
Over-destruction is the other failure mode. Reimaging immediately, in whatever order machines come to hand, destroys the telemetry required to prove eradication. Without proof of eradication, every restore afterward is a gamble.
Assume email and Teams are compromised. Coordinate over something the attacker is not sitting inside, then call IR counsel and a response firm on that channel.
A single message sent without preparation can raise the demand, reset a deadline, or reveal exactly how much pressure you are under. Once a group knows the victim is negotiating alone, terms rarely improve.
The note identifies the variant, and the variant determines whether a recovery path exists. Firewall, VPN, EDR, and domain controller logs age out on their own schedule, and they establish both how the attacker got in and what they took.
Unsure about any of this? Call. There is no charge for the conversation that tells you where you stand.
Proven Data has responded to ransomware since 2011. In 2023, under new leadership and with a completely new team, we rebuilt the company's core values around a single commitment: pursue the remediation outcome that best serves each client, not the one that closes fastest and not the one that is easiest to bill.
In practice, every engagement starts with recovery. Our in-house R&D team works the encryption itself, the backups, and the artifacts left behind, and many of the cases we take resolve there, with no threat actor contact and no payment.
OFAC-compliant cyber settlement is a last resort. It exists for the cases where every recovery path has been exhausted and the business genuinely cannot continue without the data. We would rather tell you recovery worked.
Settlement is a capability we maintain, not a service we sell you into.
Recovery is not a formality we perform before recommending payment. It is a technical discipline our R&D team runs in parallel with containment, and it is where most of our cases end.
Ransomware is written under deadline by people who make mistakes. Flawed key generation, reused keys, and broken implementations all create openings. We maintain ongoing research against active strains specifically to find them.
Attackers target backups first, but deleted rarely means gone. Veeam, Acronis, VMware snapshots, immutable tiers, and offsite replicas frequently survive in a recoverable state. In virtualized environments, the storage assessment in the first hours is the finding that decides everything: whether this is a restore exercise or a salvage and negotiation exercise.
Volume shadow copies, temp files, and partially encrypted files are recoverable far more often than most teams assume, particularly when nobody has rebooted the affected systems.
Many strains encrypt only portions of large files to work faster. Databases, virtual disks, and mail stores can often be reconstructed from what the attacker left intact.
When one of these works, the incident ends without a ransom, without threat actor contact, and frequently faster than a negotiation would have taken.
The most common misconception we encounter is how long it takes to get back online when backups are intact and restorable. In the cases that stretch into weeks, the bottleneck is almost never data restoration. It is trust.
Confirming the full scope of the breach, identifying the root cause, and verifying it is actually closed is demanding work that sits between forensic analysis and hands-on incident response. Restoring before that is finished means doing it again.
Untested backups, encrypted backups, and restore throughput nobody has ever measured. The first real test of a backup plan should not be the day you need it.
Getting a server back is fast. Getting the business owner to certify that the ERP, its database, its interfaces, and its data are all correct is not.
Insurance approval cycles, counsel review, and executive indecision consume more wall-clock time in many cases than any technical task on the list.
We work these in parallel rather than in sequence, and we tell you which one is actually holding up your recovery instead of giving you a date we cannot defend.
Sometimes recovery is not enough. The encryption holds, the backups are genuinely gone, or stolen data is the real exposure. If that is where your case lands, we tell you directly, explain what payment does and does not solve, and you decide. You are never handed a recommendation without the reasoning behind it.
The negotiation itself is handled by people, not software. Your case has a named lead who runs every communication, keeps you informed between exchanges, and stays with the incident through final data recovery.
Identify the variant, read the demand, evaluate recovery viability, and confirm what the attacker actually holds. Nobody contacts the threat actor until we know where you stand.
Not every attacker is who the note claims. Leaked builders circulate widely, and copycats run campaigns under borrowed brand names. The distinction matters: an established operation has brand economics that push it to deliver a working decryptor, while a copycat has no reputation to protect and a materially higher chance of taking payment and disappearing. We establish which you are facing before anyone considers paying.
Before a single message is sent, we review how that specific group has behaved across the cases we have handled and the public record: their pricing patterns, their escalation habits, their deadline behavior, whether their decryptors work, whether their deletion promises have ever held. Our technology does this analysis in minutes. Our negotiators decide what to do with it. You walk in prepared instead of reacting.
We require the threat actor to prove they can actually decrypt your files, and to substantiate any claim about stolen data, before settlement is on the table. Unverified claims are common, and in ransomware-as-a-service operations the person in the chat may not control the person holding your data.
Your lead negotiator controls the pace and the framing and keeps you out of direct contact. The goal is the smallest possible settlement on the best possible terms, and frequently, information that changes the picture entirely. Deadlines routinely slip, and publication costs the attacker their leverage, which is why deliberate stalling is a tool rather than a risk when it is handled by people who have done it before.
Full OFAC sanctions screening before any funds move, coordination with your counsel and carrier, and documentation structured to hold up under legal and regulatory review. We will not facilitate a payment that violates sanctions, on any timeline, for any client.
Threat actor decryptors fail constantly. They corrupt files, skip data, or run for weeks. Our engagement includes post-settlement engineering to diagnose failed decryptors, extract keys, repair corruption, and get your data actually restored. Payment is not the finish line. Working data is.
Close the access vector, verify the environment is clean, prove eradication, and document the incident for your insurer and regulators.
The moment stolen data appears publicly, the nature of the incident changes. Exfiltration is no longer alleged or suspected. It is confirmed, and the leverage event the attacker has been threatening has already happened.
The right move is to reclassify the incident on the spot. This is no longer a containment problem, because containment implies there is still something to prevent, and there is not. From that minute forward the data should be treated as permanently public, and the response becomes a breach notification and harm reduction exercise rather than a technical one. Everything downstream, your legal obligations, customer trust, and regulatory exposure, flows from accepting that immediately rather than spending days hoping it can be walked back.
Preserve the evidence. Capture the leak site listing, the timestamps, and samples of the published data. Your counsel will need all of it.
Run the notification clock analysis. Publication does not merely threaten regulatory exposure. It frequently starts it. GDPR's seventy-two hour clock, the patchwork of US state breach laws, and sectoral regimes including HIPAA, GLBA, and the SEC's four business day disclosure rule for public companies each have their own triggers. Counsel needs to determine which clocks are already running before they run out.
Prepare communications before you need them. Holding statements, customer and partner outreach, and employee briefings, drafted in parallel with the technical work rather than after it.
Realistically, it does not work. Payment for deletion is unverifiable by construction, and it has failed publicly and repeatedly. When Operation Cronos dismantled LockBit's infrastructure in February 2024, law enforcement found data belonging to victims who had paid specifically for its deletion. The group had simply kept it. The 2025 breach of LockBit's own affiliate panel reinforced the picture, and incident data through 2026 continues to document cases where data was retained or resurfaced after payment. We will tell you this before you spend money on it.
Weaponization is the norm rather than the exception. Leaked invoices, contracts, and executive correspondence are common business email compromise pretexts, and follow-on fraud against your customers and suppliers is routine, because the leaked material tells a fraudster exactly who pays whom, how much, and on what terms. Credential dumps from leak data feed credential stuffing attacks within days of publication. Planning for that is part of the response, not an afterthought.
In most jurisdictions, yes, with one critical exception. OFAC sanctions make payments to certain groups and individuals illegal regardless of circumstance, and the penalties fall on the victim organization. We run full sanctions screening on every case before any funds move, coordinate with your counsel, and document the process. If a payment cannot be made compliantly, we tell you, and we find another route.
Most cyber policies cover incident response, recovery, and, where lawfully permitted, settlement. What carriers require is documentation: scoping, forensic findings, and a defensible record of the decisions made.
We produce that documentation the same way whether your case resolves through recovery or through settlement. That is deliberate. No client should feel steered toward payment because it makes for a more straightforward claim. We coordinate with your carrier and breach counsel from day one so the path that is best for your business is also the path that is supported.
An organization in a ransomware incident is usually at its worst moment. People are exhausted, frightened, and being asked to make consequential decisions about a process entirely foreign to them. The firm you bring in should absorb that weight rather than add to it.
Our response is led by GIAC-certified forensics and incident response practitioners who have run global-scale investigations, and it is the same team from the first call through final data recovery. You will know who is handling your case and how to reach them, and every decision gets explained in language your board and your IT staff can both follow.
Recovery engineering, negotiation, compliance, and forensics sit under one roof. You are not coordinating three vendors during the worst week your company has had.
FAQ
Only when nothing else will restore the business, and most of the cases we take never get there. Our recovery team exhausts encryption analysis, backup and replica recovery, shadow copy carving, and artifact reconstruction first. Settlement exists for the cases where those genuinely fail.
Usually not. A negotiation means days of exchanges before you receive anything, and threat actor decryptors frequently fail or corrupt data once they arrive, adding another week. Recovery runs in parallel with containment from the first hour and often returns data sooner at no ransom cost. In the cases that do run long, the bottleneck is rarely restoration speed. It is proving eradication, validating applications, and waiting on approval cycles, and those delays apply whether or not a ransom is paid.
Isolate aggressively but deliberately. Sever network connectivity at the switch ports, VLANs, and VPN concentrator rather than powering systems off, and isolate domain controllers and backup repositories first. Then move to an out-of-band channel, because email and Teams should be assumed compromised, and call counsel and a response firm from there.
No. Reimaging immediately destroys the telemetry needed to prove the attacker is actually gone. Without proof of eradication, every system you restore afterward is a gamble, and re-encryption of restored systems is one of the most common ways an incident doubles in length.
Almost never. Deletion cannot be verified, and there is documented evidence of groups keeping data that victims paid to have destroyed, including data recovered by law enforcement from LockBit's infrastructure after Operation Cronos. At that point the sound response is to treat the data as permanently public and shift to evidence preservation, notification obligations, and harm reduction. We will say that plainly rather than take a fee for a settlement that buys you nothing.
Yes. Layered pressure beyond encryption and leak threats is now standard practice. Groups have contacted customers directly, launched DDoS attacks during negotiations, and in one documented case an operation filed an SEC complaint against its own victim for failing to disclose the breach in time, turning the victim's compliance obligations into the pressure mechanism. Knowing a given group's escalation pattern in advance is part of why preparation matters before the first message is sent.
Leaked ransomware builders circulate widely, and unaffiliated actors run copycat campaigns under established brand names. We verify authenticity through the negotiation infrastructure, the leak site, and binary analysis of the sample. It matters: an established operation has commercial reasons to deliver a working decryptor, while a copycat has none, and deletion promises that are already unreliable from the real group are worthless from an impostor.
More common than most people expect. Our engagement includes post-settlement engineering: diagnosing failed decryptors, extracting keys, reverse engineering the attacker's tooling, and repairing corrupted output. The work is not done until your data is usable.
It varies substantially by group. Some negotiate meaningfully, some barely move. We give you a realistic range for the specific group you are facing before negotiations begin, based on how they have actually behaved, rather than a promise we cannot keep.
Yes, routinely. We operate under attorney-client privilege at counsel's direction and coordinate with carriers on scoping, claims documentation, and reporting throughout.
Exfiltration changes the calculus entirely, because a decryption key does not undo a theft. Where attacker tooling has interfered with endpoint monitoring, host-level detail about exactly which files were read can be genuinely lost, and the scoping standard shifts from what they took to what they could have taken. We rebuild the picture from network, cloud, and post-mortem forensic evidence that does not depend on the endpoint sensor, and scope your notification obligations against what can actually be established.
A complete record: threat actor communications, OFAC screening results, forensic findings and root cause, settlement documentation where applicable, recovery reports, and an executive summary for your board and regulators.
Nothing. The initial conversation tells you what you are facing and what your realistic options are. You decide from there.
Core Capabilities
From threat actor preparation to rigorous OFAC screening and post-settlement support, every step of the settlement process is covered.
Before the first message is sent, we review how the specific group has behaved across the cases we have handled and the public record. Our technology does that analysis in minutes. Our negotiators, not software, decide what to do with it.
Every settlement goes through rigorous compliance screening. Full OFAC sanctions verification, legal documentation, and properly structured settlement execution, ensuring every payment path is legally defensible.
Settlement doesn't end at payment. Our service includes a flat-fee block of hours for decryptor resolution, because threat actor decryptors frequently fail, produce corrupted output, or miss files entirely.
Full-Spectrum Response
Our services work together to cover every phase of an incident, from first response through full recovery.
Whether you are in an active incident or trying to understand your options before deciding anything, our team is available around the clock. Recovery first. Settlement only if there is no other way. Straight answers either way.
Start Emergency Response1 (877) 364-5161Answered 24/7
