What does a police takedown of a ransomware group mean for victims?

Sometimes a lot, often less than the headlines suggest. When police seize a group's servers, they may recover decryption keys: in the Hive operation announced in January 2023, the FBI said it had given keys to more than 300 victims under attack and over 1,000 earlier victims, and Operation Cronos against LockBit in February 2024 yielded more than 1,000 keys. Victims can ask their national police whether keys exist for their case, and No More Ransom often publishes tools afterwards. Seized data can also stop further leaks. But a takedown rarely removes the people: affiliates move to other platforms, and in several cases members reappeared under a new name within months. For companies not yet attacked, it changes little. The same techniques continue under other brands, so the defences recommended in the advisories remain the ones to apply.

← All 25 questions on Ransomware groups and familiesAll topics