Hello, Thank you for your fast reply and for engaging in the discussion. We will explain the whole process in this email. As you are aware, we got access to your computers and took a very large dataset. We looked through files and the amount of sensitive data is huge. It can be very critical for your company if leaked. We want to get a payment for the confidentiality of this situation and deletion of this data. The faster we agree on everything - bigger discount we will be able to provide. We want to find a solution that will suit both parties If you are not going to reply to our emails for more than 1 day, it will be considered as unwillingness to communicate and data will be posted on our website immediately. Here we attach a file tree with all the files that we took. You need to choose up to 10 RANDOM FILES from this tree and we will send it to you, so you can be sure that the files belong to your organization. After we show you the files, we will give you some time to review it and we will move on to the price negotiations. We will announce the price after we show you the files, so you can be sure that we actually have them. After you complete the payment we will send you the server with all the data that we took , give you a detailed explanation of how we got into the net, provide you with cyber security advice and record video evidence of us deleting the data. Talking about assurance, We will try to build trust between our organization, by providing you with evidence of us always doing what we promised to other clients, so you can be 100% sure that all aspects of the deal are going to be completed. If you have any questions let us know. Please let us know that you received the information and the file tree. One attachment • Scanned by Gmail

We have sent you the complete file tree and are waiting for a list of file names today.

Here are the files that you requested, We believe this is enough evidence. Our team has reviewed the files, your financial capabilities and background and has set a price of $1.800.000 USD. If we agree on everything quickly We can guarantee you a good discount from this price. Once the payment is made you will receive the server with all files, video evidence of Us deleting all the possible copies of the data, security advice from Our team on how to fix an exploit that We found and also a guarantee of immunity from Our organization. Please review the files and get back to Us. We will be waiting on your response. Don't forget, communication has to remain on a daily basis in order to meet a peaceful end. 10 Attachments • Scanned by Gmail

We would like to explain why we never lie to our clients and why you can be 100% confident that we will keep everything confidential after you pay us. Our business is built on reputation - if a company were to pay us and, for some reason, we broke our promise, word would spread, negatively impacting our future deals. Clearly, that is not in our interest, as it would lead to a loss of trust from clients. This is the first and most important rule in our industry. You will not find a single case where, after payment, organizations like ours have failed to keep their promises. Leaking the data of paying clients would only harm our own business in the long run. More importantly, we have nothing against your business and are not interested in disrupting your operations. This is purely a way to make money - nothing more. You are not the first client and you won't be the last, We are communicating with 5 more organizations right now. To confirm our words We are attaching evidence and even some good comments from clients. Please look at these screenshots. These are 4 different cases. You can see the dates of those. Some are 2 years old, others are more recent. As for the price, We are negotiating because we need to find a price that is acceptable to both organizations, and we are waiting for your proposal on the amount you can offer us. 4 Attachments • Scanned by Gmail

Reasonability of the demand is clear. We will remind you of some points in order to clarify again. 1. The amount and the quality of the data involved is indeed serious and will destroy your reputation in case of a data leak , the figure We are demanding will be several times lower than what you will spend on settling collective lawsuits, regulatory fines to the US government, reputational losses, financial damage because of losing clients due to this incident as well as repairing what you have lost and securing your systems through external cyber specialists. 2. Each case is individual and We set a price for each case based on many factors, such as your financial capabilities and background. 3. Speaking of background , your firm is suffering from multiple lawsuits against itself in different courts which are jeopardizing your reputation already , a data breach could only put the existence of your firm in danger. Besides, As a firm participating in the cyber security field and especially after winning a cyber incident case, your name will Glow on the news as The Victim. And this all will cost much more than the figure We demand. As We have clarified before , in case We do not meet a mutual path , We will publish your data, contact all your employees and clients and inform them about the incident. They will terminate their contracts with you , in easy words, you will not be able to make any money , also , they will file lawsuits against your firm for failure to employ reasonable security measures under Section 5 of the Federal Trade Commission Act, 15 U.S.C. §. This will not only have unbearable reputational losses but also significant financial losses. We are expecting an offer close to Our figure by the end of today. In case there is no reasonable offer on the table, We will set a timer on Our website, once the timer runs out , We will publish the data set and follow Our plan of action that We described and make sure you will face unbearable consequences beyond your capabilities to survive. Below you can visit Our website, check other organizations that have decided not to make a wise decision and face the consequences, and you can find your firm among them if there will be no offer or agreement.

We have reviewed your statements. In Our last messages We have clarified the reasonability of Our demand, generously reduced the price and given you enough time to take all the necessary steps to make a wise decision. However, on the other hand , from your side We do not see any sensible progress, it is best for your firm to bring an offer on the table close to Our figure instead of stalling for time. As We have mentioned, each case is special and a price will be set on the basis of many factors. The process of gathering the funds is not Our concern , and that's exactly the point , a data breach on top of the active lawsuits against your firm will only lead you to even greater losses , therefore , if you want to save your business from more severe damages and even from being shut down , you can take loans. A reasonable offer close to Our figure should be on the table on Monday. If not, We will emphasize once more, a timer will be set on Our website, once the timer runs out, We will publish all your data, contact all your employees and clients and inform them about the incident.

We meant that We would generously lower Our initial offer only if We see your willingness for a quick agreement, however, We do not see any sensible progress on your part to bring a reasonable offer on the table. Instead of wasting time, the best thing you can do to make this negotiation head in the right direction is to gather your executives and make a wise decision that can prevent your firm from being forced to close and lose much more money than the figure We demand. There should be an offer on the table on Monday, otherwise , you can find the timer on Our website.

As We have clarified before, ignorance will be considered as no willingness to bring a peaceful end to this matter. Our course of action is clear as well. Therefore, a 24 hour timer has been set on Our website with a part of your name, if there is no offer close to Our figure on the table before the deadline, once the timer runs out We will publish all your data, contact all your employees and clients and inform them about the incident. All the consequences you were reminded of by Us will be happening to your firm and the results will only put the existence of your firm in danger. Bellow you can find your firm by the name of ( W... S... H...)

We have proved Our willingness to meet a mutual path by giving you enough time to do your internal discussions and bring an offer , however, there is no offer from your decision makers on the table yet. The timer will not be removed until there is an offer on the table as We have clarified Our courses of action for you . Again, to show Our willingness to bring an end to this deal We are ready to reduce Our figure to $1,530,000. You have more than enough time to bring a serious offer on the table, otherwise , once the timer runs out, your data will be published, all your employees and clients will be informed about the incident and you will face the consequences We have reminded you of.

Your data will be uploaded in 30 minutes.

We are waiting for your offer, and we will only begin removing your name and information from our website once we receive it.

As a final gesture of goodwill to find a peaceful resolution, we have removed your name from the website and set a one-hour timer. If we do not receive a proposal from you by the time the timer expires, we will publish your information and begin contacting your clients, relevant media outlets, and regulators. We will also do everything in our power to cause you maximum harm. You have already demonstrated our willingness to reach a deal on several occasions. The decision is yours; you have one hour.

Don’t shift the blame—you are the ones who caused this "disruption" by ignoring our demands. You had 10 hours to respond with an offer after we told you what would happen if you didn’t reply. We refuse to enter into a deal with you under these terms. Now keep a close eye on the timer—you should understand by now that we do what we promise. 1. Offering $15,000 to protect the integrity of your company’s reputation is unacceptable. 2. The volume and sensitivity of the data are so significant that the leak of such a dataset will destroy your reputation. This will have a long-term impact on your organization, and you will not be able to recover from it. And this cannot be resolved for $15,000. 3. We will publish much more of your data on our website if an agreement is not reached. Just imagine what your customers will think when they see that you were only willing to pay $15,000 to protect their data—it looks like a joke So the best way for you to prevent your organization from significant reputational and financial losses and further attacks by us is to offer a reasonable amount close to ours. We have reset the timer to 18 hours. Before the timer expires, we must see a more reasonable figure from you, and if it is in the five-figure range, this will be considered the end of the dialogue on your part, and your data will be published, and all our actions will be carried out. In the meantime, as a sign of our willingness to work with you, we are offering an initial discount and lowering our asking price to $1,330,000 USD.

Our adjustments and the time we have given you to do your internal discussions and bring a reasonable offer Indeed is a sign of Our willingness to work with you. However , on the other hand , your offer does not reflect the seriousness of the matter and it only shows one thing, not only you do not have dignity towards your clients' private information but also towards your partners and employees and your business. Any attempt to stall for time and to convince us that Our demand is not reasonable are not going to succeed, We have told you that. The reputational losses you will face are going to cost much more than the figure We demand and We have clarified the reasons for you before. If you want to bring a peaceful end to this matter, there should be a significant increase in your offer. You have less than 5 hours to do so, otherwise , you can find your data on Our website.

Any offer less than 6 figure is not acceptable, you have one hour to decide.