[knightofmars]

It's still impossible to prove the files were deleted even if they don't release after the initial payment. All it takes is a single individual in a group to make a backup or have a default policy of keeping a backup "just in case".

One should assume at this point that it's not a question of whether the files will be leaked but when.

[euroderf]

China sure isn't going to advertise buying a copy.

[cyanydeez]

also, governments like china, North Korea , Russia, Iran are basically silent endpoints for this stuff, so assuming it's valuable data, the ransom request should trigger whatever intelligence protocols you have.

[belltaco]

The 'when' can be important too, because the sensitivity and value of data generally goes down over time.

[sofixa]

> It's still impossible to prove the files were deleted even if they don't release after the initial payment

Often the data isn't exfiltrated at all, only encrypted in place, which should be relatively easy to prove.