Ransomware negotiators help businesses deal with cybercriminals

LAS VEGAS ( InvestigateTV ) — Ransomware attacks have created an emerging job in cybersecurity as businesses turn to specialized negotiators to handle cybercriminals who hold their data hostage.

“They’re holding systems hostage, they’re holding information hostage, they’re attempting to extort people in order to monetize their efforts,” Mark Lance, a ransomware negotiator with GuidePoint Security in Virginia, said.

The need for such expertise became clear in September 2023 when MGM Resorts was targeted by a ransomware attack.

According to documents filed with the U.S. Securities and Exchange Commission, MGM reported an estimated $100 million loss from the attack. The filing also stated that some customers’ personal data was compromised.

Ransomware is a type of cybercrime that prevents companies from accessing computer files and demands a ransom for their return.

Businesses hit with ransomware hire negotiators like Lance to step in and work out payment and terms with cybercriminals to restore their systems.

“We’ve worked hundreds of cases where we’re working on behalf of these victims and what we bring is the ability to set expectations on what’s going to transpire but also educate them on what is potentially going on situationally,” Lance said.

Most company officials have no idea what to do when attacked, he said.

Cybercriminals try to create operational disturbances that prevent businesses from continuing to run until they pay for access back to their systems.

Arizona ranks eighth in the country in cybercrimes, with school districts, hospitals, and large and small businesses targeted.

Danny Seiden, president of the Arizona Chamber of Commerce, said cyberattacks in Arizona have been costing hundreds of millions of dollars every year.

According to Lance, most ransomware attacks come from cybercriminals in Eastern Europe, with a handful of gangs working from the U.K., South America and the U.S.

Ransom demands can range from a few thousand dollars to several million. One cybercriminal asked for $700 million.

“These are extremely lucrative operations for them where they are making millions - in some cases even billions of dollars on an annual basis,” Lance said.

According to cybersecurity company DeepStrike, between 2024 and 2025 the typical ransom that companies would pay dropped by half, from $2 million to $1 million.

It attributes that drop to smarter negotiations, and businesses simply refusing to pay the ransom.

The FBI says it does not support paying a ransom because paying doesn’t guarantee the organization will get any data back and it encourages perpetrators to target more victims.

Lance said it’s best for companies to bring in an IT expert the moment they detect a ransomware attack. But even better advice is for businesses to make sure they have a strong security system in place to prevent hackers from getting in.

“We have seen businesses that have had to close their doors or shutter business because of the impact,” Lance said.