Delta Crisis Experts: How Firms Should Negotiate Ransomware

Ransomware attacks are no longer a problem reserved for large corporations with deep pockets and dedicated security teams. According to Michael Sjøberg and Peter Skovbo of Delta Crisis, mid-sized businesses, the backbone of many national economies, are increasingly finding themselves paralyzed by attackers who encrypt critical systems and demand payment to restore access. Their guidance, published via Handelsblatt, offers a rare inside look at how companies actually negotiate with cyber extortionists, and what steps can reduce the damage before an attack even happens.

Why Mid-Sized Companies Are the New Target

For years, ransomware headlines focused on hospitals, government agencies, and multinational corporations. That picture is changing. Attackers have realized that smaller and mid-sized firms often lack the layered defenses of larger enterprises, yet still hold valuable data and cannot afford prolonged downtime. This shift mirrors a broader trend documented elsewhere in the ransomware ecosystem, where some groups have moved toward what researchers call area suppression of SME networks, targeting entire clusters of smaller organizations rather than painstakingly selecting single high-value victims. The logic is simple: volume replaces precision, and even modest ransom payments add up when multiplied across dozens of victims.

Delta Crisis's experience suggests that once an attack hits, the difference between a company that recovers with limited damage and one that suffers lasting harm often comes down to preparation and how the negotiation itself is handled in the first hours and days.

Inside a Ransomware Negotiation

According to Sjøberg and Skovbo, negotiating with cyber-criminals is not simply about deciding whether to pay. It requires understanding the attacker's business model, verifying what data has actually been stolen or encrypted, and managing communication in a way that neither provokes the group into destroying data nor signals desperation that could drive up the demand. This is delicate work, and it increasingly resembles a professional service industry on both sides of the table. That professionalization is visible across the ransomware landscape more broadly. Groups have adopted structured ransomware-as-a-service models, a pattern also seen in warnings about Gunra ransomware's expansion into a RaaS operation, where affiliates run attacks using tools built by a core group in exchange for a share of the proceeds. The result is a more scalable, repeatable extortion process, which is exactly why negotiation strategy matters so much for the victim.

The entry point for many of these attacks also deserves attention. Attackers frequently gain initial access through social engineering rather than exploiting obscure technical flaws. Campaigns abusing tools like Microsoft Teams to impersonate fake IT support staff show how a single convincing phone call or chat message can open the door to a full network compromise, long before any ransom note appears.

The Privacy and Data Exposure Stakes

Ransomware negotiation is not only about restoring access to encrypted files. Modern ransomware groups typically steal data before encrypting it, then threaten to publish or sell that information if payment is not made. This double extortion model raises the stakes considerably for privacy. Customer records, employee data, and confidential business information can end up exposed regardless of whether a company pays. Attackers have also grown more sophisticated at evading detection during the intrusion phase, including techniques that disable security tools outright, as seen in reporting on GodDamn ransomware abusing a signed driver to kill antivirus software. That kind of stealth means a breach can go unnoticed for far longer, giving attackers more time to exfiltrate sensitive data before anyone realizes something is wrong.

What This Means For You

If you run or work at a mid-sized company, the message from Delta Crisis is clear: ransomware readiness is no longer optional, and it starts well before an attack occurs. Basic hygiene, offline backups, tested incident response plans, and staff training against social engineering, remains the strongest defense. If an attack does happen, the decision of whether and how to negotiate should never be made in isolation or under panic. Experienced negotiators understand attacker psychology, verify claims before trusting them, and know how to buy time without escalating threats against stolen data.

For individuals whose data may sit inside a company's systems, this also underscores why organizations owe customers transparency when a breach occurs, since ransomware negotiations directly affect whether personal information stays private or ends up leaked.

Key Takeaways

Companies of every size should treat ransomware as a when, not an if, scenario. Build an incident response plan before an attack, maintain tested offline backups, and identify in advance who will handle communication if extortionists make contact. Train staff to recognize social engineering attempts, particularly impersonation through everyday collaboration tools. If negotiation becomes necessary, involve experienced professionals rather than improvising, since the way a company responds in the first hours can shape both the financial outcome and how much personal or corporate data ultimately gets exposed.