So, they paid the attackers. Sure, the attackers may not sell or dump the data publicly, but you can bet your arse that they have a copy and will use it in future phishing campaigns or other scams.

That’s… not how any of that works. 🫪

We had a guy at work that was emailed some personal data by accident from HR.

He questioned what it was about and HR asked him to send the data back to them.

People in important roles just don’t understand techology.

(Yes, of course we cracked the password and opened it)