On Behalf of Our Customers for Security

• Client: Global logistics and freight forwarding company with approximately 1,200 employees.
• Threat: Encryption of central dispatch systems during peak operations, combined with the exfiltration of customs and freight documents (double extortion). Initial ransom demand: USD 3.2 million.
• Result: Ransom demand reduced by 75% through strategic negotiation.
• Decryptor obtained: Full decryption of all core systems without data loss within 24 hours of reaching an agreement.
• Data protected: Exfiltrated data successfully secured; no publication on the attackers’ leak site.

“The failure of our dispatch systems brought our global fleet to a standstill. The negotiation team acted with absolute professionalism. They not only reduced the ransom dramatically but also saved us from potentially devastating consequences by securing a fully functional decryptor. Not a single document was made public.”

• Client: Medium-sized, world-leading machinery and plant engineering company.
• Threat: Ransomware infection affecting the entire production line and development databases, including CAD design files. Attackers threatened to sell trade secrets to competitors. Initial ransom demand: EUR 1.8 million.
• Result: Demand successfully reduced to an economically manageable minimum – approximately 20% of the initial amount.
• Decryptor obtained: The decryption tool was validated in advance using a test file and delivered fully functional after payment.
• IP protected: Exfiltrated know-how and patent-related information remained protected; subsequent darknet monitoring showed no evidence of publication.

“The thought of our patented designs ending up on the darknet was our absolute nightmare. The negotiation led by RiskWorkers maneuvered the attackers with exceptional psychological skill, dramatically reduced the ransom, and secured the decryptor. Thanks to this disciplined approach, our market leadership remained intact.”

• Client: National construction and project development company.
• Threat: Complete encryption of project drives, costing data, and subcontractor agreements shortly before a major tender deadline. Initial ransom demand: EUR 950,000.
• Result: The negotiation strategy leveraged the project company’s tight liquidity constraints to reduce the ransom by 85%.
• Decryptor obtained: Transaction process monitored and decryption key provided promptly.
• Reputation protected: Sensitive costing and bidding data remained confidential, preventing construction shutdowns and potential claims for damages.

“Major construction sites were facing shutdown because we could no longer access structural calculations and plans. The RiskWorkers team immediately took control of the situation. They negotiated the ransom down dramatically and secured the release of our data. There were no leaks.”

• Client: Social welfare organization operating numerous care and support facilities.
• Threat: Compromise of HR and payroll systems and theft of sensitive employee and client records. The attackers threatened to contact vulnerable care recipients directly. Initial ransom demand: EUR 600,000.
• Result: By demonstrating the organization’s nonprofit status and extremely limited financial resources, the ransom was negotiated down to a minimum in the darknet chat.
• Decryptor obtained: Reliable delivery of the decryption key enabled salaries to be paid on time.
• Individuals protected: Attackers were prevented from contacting or extorting individuals, and no sensitive information was published online.

“Attacking a social welfare organization may be morally reprehensible, but to the perpetrators it is simply business. The negotiation team led by RiskWorkers understood this dynamic, took the emotional burden off our shoulders, and negotiated the ransom down dramatically. The decryptor worked immediately. At no point were our clients harassed.”

• Client: Hospital group with several locations and an affiliated emergency center.
• Threat: Cyberattack during ongoing hospital operations, encrypting digital patient records (HIS) and interfaces to medical devices and creating an acute risk to clinical operations. Initial ransom demand: USD 4.5 million.
• Result: Taking the organization’s critical infrastructure status into account and using specialized negotiation tactics, the ransom was drastically reduced without losing valuable time.
• Decryptor obtained: Prioritized negotiations resulted in the decryptor being provided as quickly as possible, allowing the hospital to end emergency operations and restore critical systems.
• No data leak: Highly sensitive patient data, including diagnoses and medical histories, remained protected from publication.

“When hospital monitors go dark, lives are at stake. The RiskWorkers negotiation team performed flawlessly under unimaginable pressure. They brought the attackers to a rapid agreement, dramatically reduced the ransom, and secured the vital decryptor. A data leak was completely prevented.”