{ "metrics": { "total_demanded_usd": 675051000, "total_paid_usd": 218900000, "total_recovered_usd": 50500000, "overall_recovery_rate_pct": 23.1, "tracked_incidents_count": 8 }, "incidents": [ { "id": "rw-colonial-pipeline", "case_slug": "colonial-pipeline-darkside-ransomware", "name": "Colonial Pipeline Cyber Extortion", "date": "2021-05-07", "actor": "DarkSide / BlackMatter", "actor_slug": "darkside", "variant": "DarkSide", "demand_usd": 4400000, "paid_usd": 4400000, "recovered_usd": 2300000, "crypto_asset": "75.0 BTC (Demanded/Paid) -> 63.7 BTC Seized", "recovery_pct": 52.3, "mixer_used": "Unknown BTC Mixer", "court_docket": "1:21-mj-00424 (D.D.C.)", "outcome": "DOJ Asset Forfeiture Seizure", "summary": "Colonial Pipeline paid 75 Bitcoin ($4.4M) to restore critical fuel pipeline operations. Within weeks, the FBI accessed the private key for the affiliate deposit address and seized 63.7 Bitcoin valued at $2.3M." }, { "id": "rw-change-healthcare", "case_slug": "alphv-blackcat-change-healthcare", "name": "Change Healthcare Nationwide Extortion", "date": "2024-02-21", "actor": "ALPHV / BlackCat", "actor_slug": "alphv-blackcat", "variant": "BlackCat / Noberus", "demand_usd": 22000000, "paid_usd": 22000000, "recovered_usd": 0, "crypto_asset": "350.0 BTC", "recovery_pct": 0.0, "mixer_used": "Wasabi Wallet & BitMix", "court_docket": "6:24-cv-00122 (M.D. Fla.)", "outcome": "Affiliate Exit Scam & Global Takedown", "summary": "UnitedHealth Group confirmed paying a $22 million ransom (approx. 350 Bitcoin) to recover patient billing systems. ALPHV operators subsequently executed an exit scam, refusing to pay their affiliate." }, { "id": "rw-kaseya-revil", "case_slug": "us-v-vasinskyi-kaseya-revil", "name": "Kaseya VSA Supply Chain Extortion", "date": "2021-07-02", "actor": "REvil / Sodinokibi", "actor_slug": "revil-sodinokibi", "variant": "Sodinokibi", "demand_usd": 70000000, "paid_usd": 0, "recovered_usd": 6100000, "crypto_asset": "Monero (XMR) & Bitcoin (BTC)", "recovery_pct": 100.0, "mixer_used": "ChipMixer & Blender.io", "court_docket": "3:21-cr-00314 (N.D. Tex.)", "outcome": "Defendant Extradited & Restitution Ordered", "summary": "REvil demanded $70 million in cryptocurrency to provide a universal decryption tool for over 1,500 compromised businesses. Law enforcement obtained master keys, and defendant Yaroslav Vasinskyi was sentenced to prison with $16M restitution." }, { "id": "rw-netwalker-vachon", "case_slug": "us-v-vachon-desjardins-netwalker", "name": "Netwalker Healthcare Extortion Campaign", "date": "2021-01-27", "actor": "Netwalker Syndicate", "actor_slug": "netwalker-syndicate", "variant": "Netwalker", "demand_usd": 27600000, "paid_usd": 21500000, "recovered_usd": 28100000, "crypto_asset": "458.8 BTC & CAD Cash Seizure", "recovery_pct": 100.0, "mixer_used": "ChipMixer", "court_docket": "8:20-cr-00355 (M.D. Fla.)", "outcome": "Defendant Sentenced to 20 Years", "summary": "Canadian affiliate Sebastien Vachon-Desjardins extorted tens of millions from hospitals and schools. Authorities seized 458.8 Bitcoin and Canadian currency totaling over $28 million. He was sentenced to 20 years in U.S. federal prison." }, { "id": "rw-jbs-revil", "case_slug": "jbs-foods-revil-extortion", "name": "JBS Foods Global Meat Processing Extortion", "date": "2021-05-30", "actor": "REvil / Sodinokibi", "actor_slug": "revil-sodinokibi", "variant": "Sodinokibi", "demand_usd": 11000000, "paid_usd": 11000000, "recovered_usd": 0, "crypto_asset": "Bitcoin (BTC)", "recovery_pct": 0.0, "mixer_used": "Hydra Market", "court_docket": "DOJ Statement June 9, 2021", "outcome": "Voluntary Corporate Payment Disclosed", "summary": "World's largest meat producer JBS paid an $11 million ransom in Bitcoin following encrypted operations across plants to prevent food supply shortages." }, { "id": "rw-cna-financial", "case_slug": "cna-financial-phoenix-extortion", "name": "CNA Financial Enterprise Insurance Hack", "date": "2021-03-21", "actor": "Evil Corp (Dridex Cartel)", "actor_slug": "evil-corp", "variant": "Phoenix Locker", "demand_usd": 40000000, "paid_usd": 40000000, "recovered_usd": 0, "crypto_asset": "Bitcoin (BTC)", "recovery_pct": 0.0, "mixer_used": "Garantex & Hydra", "court_docket": "Treasury Designation Action", "outcome": "Sanctioned Entity Extortion Payment", "summary": "Major U.S. insurance underwriter CNA Financial paid $40 million to restore internal networks after Evil Corp deployed Phoenix Locker, engineered to circumvent sanctions." }, { "id": "rw-city-of-atlanta", "case_slug": "us-v-savandi-samsam-ransomware", "name": "City of Atlanta Municipal Outage", "date": "2018-03-22", "actor": "SamSam Ransomware Group", "actor_slug": "samsam-group", "variant": "SamSam", "demand_usd": 51000, "paid_usd": 0, "recovered_usd": 0, "crypto_asset": "Bitcoin (BTC)", "recovery_pct": 0.0, "mixer_used": "WEX & BTC-e", "court_docket": "2:18-cr-00760 (D.N.J.)", "outcome": "Fugitive Indictments Unsealed", "summary": "Iranian nationals Faramarz Shahi Savandi and Mohammad Mehdi Shah Mansouri extorted over 200 public victims. Atlanta refused the $51,000 ransom, incurring over $10M in remediation costs." }, { "id": "rw-lockbit-takedown", "case_slug": "lockbit-ransomware-takedown", "name": "Operation Cronos LockBit Disruption", "date": "2024-05-07", "actor": "LockBit Syndicate", "actor_slug": "lockbit-syndicate", "variant": "LockBit 3.0", "demand_usd": 500000000, "paid_usd": 120000000, "recovered_usd": 14000000, "crypto_asset": "Tether (USDT) & Bitcoin (BTC)", "recovery_pct": 11.6, "mixer_used": "Tornado Cash & ChipMixer", "court_docket": "1:24-cr-00128 (D.N.J.)", "outcome": "Leader Unmasked & Sanctioned", "summary": "DOJ unsealed indictment against leader Dmitry Yuryevich Khoroshev. International coalition seized affiliate portals, keys, and froze cryptocurrency assets across allied nations." } ], "laundering_facilitators": [ { "name": "ChipMixer", "status": "Seized by DOJ / BKA (March 2023)", "volume_laundered_usd": "3,000,000,000+" }, { "name": "Tornado Cash", "status": "Sanctioned by OFAC (August 2022)", "volume_laundered_usd": "1,000,000,000+" }, { "name": "BTC-e", "status": "Seized by DOJ (July 2017)", "volume_laundered_usd": "4,000,000,000+" }, { "name": "Blender.io", "status": "Sanctioned by OFAC (May 2022)", "volume_laundered_usd": "500,000,000+" }, { "name": "Garantex", "status": "Sanctioned by OFAC (April 2022)", "volume_laundered_usd": "2,000,000,000+" } ] }