Ransom Busters Claims It Hacked Ransomware Servers, Asks Victims for Up to $60,000

A ransomware affiliate calling itself Ransom Busters has been spotted proactively sending emails to victim organizations and claims to delete stolen data from ransomware groups' servers in exchange for a fee ranging from $20,000 to $60,000. "In these messages, the third-party offers to help the victim recover from ransomware attack. This immediately stands out as anomalous," GuidePoint Research

Report facts: The article describes a ransomware-affiliated group, 'Ransom Busters', contacting victim organizations and offering to delete stolen data from other ransomware groups’ servers for fees between $20,000 and $60,000, an anomalous post-incident extortion model layered on top of the original attack. RealGround analysis: While the story is primarily about human-operated cybercrime rather than AI, similar 'broker' patterns could emerge around AI-assisted extortion, data handling, and incident mediation, creating complex trust and governance risks. Organizations should prepare policies and playbooks that explicitly address unsolicited post-incident offers, AI-assisted negotiation/decision tools, and verification of any third-party claims touching stolen data. An AI Security Readiness Assessment can help define how AI systems must treat untrusted post-breach communications and ensure they do not automate responses that increase business or legal risk.