Ransom & extortion
Victim of a ransom demand or extortion? What to do right now
Ransom demand after ransomware, threat to publish data, cryptocurrency extortion, pressure on an executive: do not respond alone. Here are the first steps, then how we step in, from crisis management to evidence. If someone is physically threatened, call the police immediately.
RAID Square is a French digital investigation and cybersecurity firm specialised in crises with a cybercriminal dimension. Facing a ransom demand or extortion, we secure the exchanges, assess the threat and the credibility of the perpetrators, trace cryptocurrency payments, coordinate with the authorities and build admissible evidence. More than 500 operations carried out, very fast response.
The first 5 steps
- 1
Do not pay, do not negotiate alone
No payment before an assessment: paying guarantees neither recovery nor silence. Buy time without provoking, and get support from the very first exchange.
- 2
Freeze the situation
Delete nothing, reinstall nothing. Isolate the affected machines, keep the ransom note, payment addresses, messages and screenshots.
- 3
Assess the threat
What do the perpetrators really hold? Ask for proof, check their credibility and track record: this decides the strategy.
- 4
Alert the right people
Law enforcement (immediately if there is a physical threat), Cybermalveillance.gouv.fr, your cyber insurer and your counsel. Appoint a single person to talk to the perpetrators.
- 5
Prepare what comes next
Internal and external communication, CNIL notification if personal data is involved, evidence for the complaint and the insurer.
How we support you
Crisis management, threat assessment, fund tracing and evidence: one team, answering very quickly, usually on weekends too.
Describe my situationCrisis management
Crisis cell, priorities, a single communication channel with the perpetrators and coordination with the authorities.
Threat assessment
Analysis of samples, OSINT on the perpetrators, credibility and track record of the group, scenarios and recommendations.
Fund tracing and freezing
On-chain tracing of ransom addresses and payments, identification of the platforms and documented freeze requests.
Evidence and proceedings
Admissible expert report, support for the complaint and the insurance file, digital protection of threatened people and, when needed, physical protection by our CNAPS-licensed partner.
Common situations
- Ransomware with encryption and data theft
- Blackmail threatening to publish data (double extortion)
- Image or reputation blackmail targeting an executive
- Cryptocurrency extortion after a wallet hack
- Threats against an executive or their family linked to their assets
- Fake recovery services demanding upfront fees
Why RAID Square
Technical expertise for the courts
Regularly called upon in court cases, alongside law firms, courts, liquidators and elite government units.
Very fast response
A crisis gives no warning: we answer very quickly, usually on weekends too, with emergency tracing that enables funds to be frozen.
100% French and self-funded
A self-funded, independent and sovereign company: the confidentiality of your case is a condition, not an option.
Frequently asked questions
- Should I pay the ransom?
- The authorities advise against it and so do we by default: paying guarantees nothing and funds crime. When the question arises, the decision must be taken with counsel after assessing the threat and tracing the payment addresses.
- Can you identify the perpetrators?
- Often partially: group, infrastructure, addresses and platforms used. These elements feed the complaint and the freeze requests. We never promise identification or recovery.
- What if the threat is physical?
- Call the police immediately. We then assess the digital exposure of the person targeted and, if needed, activate our close protection partner, licensed by CNAPS.
- Who should talk to the attackers?
- A single, designated and prepared person, on a single channel. We support them at every exchange: tone, deadlines, requests for proof, while tracing the payment addresses in parallel.
Contact
Describe the situation
Nature of the threat, deadline imposed, amount demanded and what you have already done. If someone is physically threatened, call the police immediately.