Ragnar Locker ransomware group threatens to publish stolen data if victims contact authorities

This week, an announcement has been made by The Ragnar Locker ransomware group on their data leak site, warning that they will leak stolen data from their victims that contact any law enforcement authorities. This warning also stated that hiring any recovery companies for negotiations will be seen as a hostile move against them and therefore they will publish the compromised data they have.

“So from this moment we warn all our clients, if you will hire any recovery company for negotiations or if you will send requests to the police/FBI/investigators, we will consider this as a hostile intent and we will initiate the publication of whole compromised data immediately,” – Ragnar Locker

This announcement hasn’t been taken lightly as the Ragnar Locker group are well-known for using double extortion measures where it encrypts files and steals data, before demanding a ransom payment and using the threat of publishing the stolen data as an incentive to pay the ransom.

There is a concern that other ransomware groups may adopt this tactic but there is the issue of organisations requiring to report breaches that include regulated data like medical records to key authorities as a matter of law. Therefore, organisations could be put in a difficult position because if they do conceal these incidents from authorities then they could risk facing harsh legal penalties due to laws like GDPR.