Silent Ransom Group’s Chat Leaks Reveal $207 Million Data‑Extortion Scheme That Skipped Encryption

Leaked internal chat logs from the cyber‑crime outfit known as Silent Ransom show the group amassed $206.95 million from 27 victim companies in roughly a six‑month period, all without ever encrypting the targeted data. The communications, obtained by a cybersecurity outlet, detail how the attackers relied on stolen files alone to force payments.

The logs, which appear to be excerpts from a private messaging platform used by the gang, were shared with researchers after a whistleblower uploaded them to an encrypted drop site. Analysts say the authenticity of the messages is supported by timestamps, consistent slang, and references to specific ransom negotiations that match previously reported incidents.

Silent Ransom’s approach exemplifies a growing trend known as “double extortion,” where criminals exfiltrate sensitive information and threaten public release unless a fee is paid. Unlike classic ransomware that locks files behind encryption, this model sidesteps the technical step of encrypting data, reducing the risk of decryption failures and allowing attackers to demand higher sums based on the perceived value of the stolen records.

With 27 firms paying an average of roughly $7.7 million each, the scheme underscores how lucrative data theft can be when victims fear reputational damage, regulatory penalties, or exposure of trade secrets. The victims spanned multiple sectors, though the leaked chats do not name the companies, reflecting a broad targeting strategy that leverages the high cost of data breaches across industries.

Security experts warn that the success of Silent Ransom’s non‑encryption tactic may encourage other groups to adopt similar methods, complicating defense strategies that have traditionally focused on preventing encryption. Law‑enforcement agencies are reportedly reviewing the logs as part of ongoing investigations into transnational ransomware networks, but attribution remains challenging due to the use of anonymizing services and cryptocurrency payments.

In the wake of the revelations, cybersecurity firms are urging organizations to strengthen data loss prevention controls, conduct regular exfiltration monitoring, and develop incident‑response plans that address the threat of public disclosure. As investigators piece together the full scope of the operation, the incident highlights the evolving economics of cybercrime, where the mere possession of stolen data can generate multi‑hundred‑million‑dollar payouts.