{"id":40302,"date":"2021-04-05T12:05:00","date_gmt":"2021-04-05T12:05:00","guid":{"rendered":"http:\/\/818b73ff-9633-4305-ac53-d067209b01f5"},"modified":"2021-04-05T12:05:00","modified_gmt":"2021-04-05T12:05:00","slug":"ransomware-a-company-paid-millions-to-get-their-data-back-but-forgot-to-do-one-thing-so-the-hackers-came-back-again","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/ransomware-a-company-paid-millions-to-get-their-data-back-but-forgot-to-do-one-thing-so-the-hackers-came-back-again\/","title":{"rendered":"Ransomware: A company paid millions to get their data back, but forgot to do one thing. So the hackers came back again"},"content":{"rendered":"
<\/div>\n

A company that fell victim to a ransomware attack and paid cyber criminals millions for the decryption key to restore their network fell victim to the exact same ransomware gang under two weeks later after failing to examine why the attack was able to happen in the first place. <\/p>\n

The cautionary tale is detailed by the UK’s National Cyber Security Centre (NCSC) in a blog post about the rise of ransomware<\/a>. <\/p>\n

\n

ZDNet Recommends<\/span> <\/h3>\n<\/p><\/div>\n

The unnamed company fell victim to a ransomware attack and paid millions in bitcoin<\/a> in order to restore the network and retrieve the files. <\/p>\n

SEE: <\/strong><\/strong>Network security policy<\/strong><\/strong><\/a> (TechRepublic Premium)<\/strong><\/strong> <\/p>\n

However, the company just left it at that, failing to analyse how cyber criminals infiltrated the network \u2013 something that came back to haunt them when the same ransomware gang infected the network with the same ransomware less than two weeks later. The company ended up paying a ransom a second time. <\/p>\n

“We’ve heard of one organisation that paid a ransom (a little under \u00a36.5million with today’s exchange rates) and recovered their files (using the supplied decryptor), without any effort to identify the root cause and secure their network. Less than two weeks later, the same attacker attacked the victim’s network again, using the same mechanism as before, and re-deployed their ransomware. The victim felt they had no other option but to pay the ransom again,” the NCSC blog said. <\/p>\n

The NCSC has detailed the incident as a lesson for other organisations \u2013 and the lesson is that if you fall victim to a ransomware attack, find out how it was possible for cyber criminals to embed themselves on the network undetected before the ransomware payload was unleashed. <\/p>\n

<\/section>\n

“For most victims that reach out to the NCSC, their first priority is \u2013 understandably \u2013 getting their data back and ensuring their business can operate again. However, the real problem is that ransomware is often just a visible symptom of a more serious network intrusion that may have persisted for days, and possibly longer,” said the blog post by an NCSC technical lead for incident management. <\/p>\n

In order to install ransomware, cyber criminals may have been able to gain backdoor access to the network \u2013 potentially via a previous malware intrusion<\/a> \u2013 as well as having administrator privileges or other login credentials<\/a>. <\/p>\n

If the attackers have that, they could easily deploy another attack if they wanted to \u2013 and did, in the example detailed above, as the victim hadn’t examined how their network was compromised. <\/p>\n

Examining the network following a ransomware incident and determining how the malware was able to enter the network as well as staying undetected for so long is, therefore, something all organisations that fall victim to ransomware should be considering alongside restoring the network \u2013 or preferably, before they even think about restoring the network. <\/p>\n

Some might believe that paying the ransom to criminals is going to be the quickest and most cost-effective means of restoring the network \u2013 but that’s also rarely the case. Because not only is the ransom paid, potentially at a cost of millions, but the post-event analysis and rebuilding of a damaged network also costs large amounts<\/a>. <\/p>\n

SEE: <\/strong>Ransomware victims aren’t reporting attacks to police. That’s causing a big problem<\/strong><\/a> <\/p>\n

And as the NCSC notes, falling victim to a ransomware attack will often lead to an extended period of disruption before operations resemble anything normal. <\/p>\n

“Recovering from a ransomware incident is rarely a speedy process. The investigation, system rebuild and data recovery often involves weeks of work,” said the post. <\/p>\n

The best way to avoid any of this is to ensure your network is secure against cyberattacks in the first place<\/a> by doing things like making sure operating systems and security patches are up to date<\/a> and applying multi-factor authentication<\/a> across the network. <\/p>\n

It’s also recommended that organisations regularly backup their networks \u2013 and store those backups offline<\/a> \u2013 so in the event of a successful ransomware attack, the network can be restored with the least disruption possible. <\/p>\n

MORE ON CYBERSECURITY<\/strong> <\/h3>\n

READ MORE HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

A cautionary tale shows how organisations that fall foul of ransomware should concentrate on finding how it happened before anything else – or they could fall victim again.
\nREAD MORE HERE…<\/p>\n","protected":false},"author":2,"featured_media":40303,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[62],"tags":[],"class_list":["post-40302","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-zdnet-security"],"yoast_head":"\nRansomware: A company paid millions to get their data back, but forgot to do one thing. So the hackers came back again 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/ransomware-a-company-paid-millions-to-get-their-data-back-but-forgot-to-do-one-thing-so-the-hackers-came-back-again\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Ransomware: A company paid millions to get their data back, but forgot to do one thing. So the hackers came back again 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/ransomware-a-company-paid-millions-to-get-their-data-back-but-forgot-to-do-one-thing-so-the-hackers-came-back-again\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2021-04-05T12:05:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2021\/04\/ransomware-a-company-paid-millions-to-get-their-data-back-but-forgot-to-do-one-thing-so-the-hackers-came-back-again.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"770\" \/>\n\t<meta property=\"og:image:height\" content=\"578\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-a-company-paid-millions-to-get-their-data-back-but-forgot-to-do-one-thing-so-the-hackers-came-back-again\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-a-company-paid-millions-to-get-their-data-back-but-forgot-to-do-one-thing-so-the-hackers-came-back-again\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"Ransomware: A company paid millions to get their data back, but forgot to do one thing. So the hackers came back again\",\"datePublished\":\"2021-04-05T12:05:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-a-company-paid-millions-to-get-their-data-back-but-forgot-to-do-one-thing-so-the-hackers-came-back-again\\\/\"},\"wordCount\":697,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-a-company-paid-millions-to-get-their-data-back-but-forgot-to-do-one-thing-so-the-hackers-came-back-again\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2021\\\/04\\\/ransomware-a-company-paid-millions-to-get-their-data-back-but-forgot-to-do-one-thing-so-the-hackers-came-back-again.jpg\",\"articleSection\":[\"ZDNet | Security\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-a-company-paid-millions-to-get-their-data-back-but-forgot-to-do-one-thing-so-the-hackers-came-back-again\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-a-company-paid-millions-to-get-their-data-back-but-forgot-to-do-one-thing-so-the-hackers-came-back-again\\\/\",\"name\":\"Ransomware: A company paid millions to get their data back, but forgot to do one thing. So the hackers came back again 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-a-company-paid-millions-to-get-their-data-back-but-forgot-to-do-one-thing-so-the-hackers-came-back-again\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-a-company-paid-millions-to-get-their-data-back-but-forgot-to-do-one-thing-so-the-hackers-came-back-again\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2021\\\/04\\\/ransomware-a-company-paid-millions-to-get-their-data-back-but-forgot-to-do-one-thing-so-the-hackers-came-back-again.jpg\",\"datePublished\":\"2021-04-05T12:05:00+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-a-company-paid-millions-to-get-their-data-back-but-forgot-to-do-one-thing-so-the-hackers-came-back-again\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-a-company-paid-millions-to-get-their-data-back-but-forgot-to-do-one-thing-so-the-hackers-came-back-again\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-a-company-paid-millions-to-get-their-data-back-but-forgot-to-do-one-thing-so-the-hackers-came-back-again\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2021\\\/04\\\/ransomware-a-company-paid-millions-to-get-their-data-back-but-forgot-to-do-one-thing-so-the-hackers-came-back-again.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2021\\\/04\\\/ransomware-a-company-paid-millions-to-get-their-data-back-but-forgot-to-do-one-thing-so-the-hackers-came-back-again.jpg\",\"width\":770,\"height\":578},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-a-company-paid-millions-to-get-their-data-back-but-forgot-to-do-one-thing-so-the-hackers-came-back-again\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Ransomware: A company paid millions to get their data back, but forgot to do one thing. So the hackers came back again\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Ransomware: A company paid millions to get their data back, but forgot to do one thing. So the hackers came back again 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/ransomware-a-company-paid-millions-to-get-their-data-back-but-forgot-to-do-one-thing-so-the-hackers-came-back-again\/","og_locale":"en_US","og_type":"article","og_title":"Ransomware: A company paid millions to get their data back, but forgot to do one thing. So the hackers came back again 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/ransomware-a-company-paid-millions-to-get-their-data-back-but-forgot-to-do-one-thing-so-the-hackers-came-back-again\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2021-04-05T12:05:00+00:00","og_image":[{"width":770,"height":578,"url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2021\/04\/ransomware-a-company-paid-millions-to-get-their-data-back-but-forgot-to-do-one-thing-so-the-hackers-came-back-again.jpg","type":"image\/jpeg"}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/ransomware-a-company-paid-millions-to-get-their-data-back-but-forgot-to-do-one-thing-so-the-hackers-came-back-again\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/ransomware-a-company-paid-millions-to-get-their-data-back-but-forgot-to-do-one-thing-so-the-hackers-came-back-again\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"Ransomware: A company paid millions to get their data back, but forgot to do one thing. So the hackers came back again","datePublished":"2021-04-05T12:05:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/ransomware-a-company-paid-millions-to-get-their-data-back-but-forgot-to-do-one-thing-so-the-hackers-came-back-again\/"},"wordCount":697,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/ransomware-a-company-paid-millions-to-get-their-data-back-but-forgot-to-do-one-thing-so-the-hackers-came-back-again\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2021\/04\/ransomware-a-company-paid-millions-to-get-their-data-back-but-forgot-to-do-one-thing-so-the-hackers-came-back-again.jpg","articleSection":["ZDNet | Security"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/ransomware-a-company-paid-millions-to-get-their-data-back-but-forgot-to-do-one-thing-so-the-hackers-came-back-again\/","url":"https:\/\/www.threatshub.org\/blog\/ransomware-a-company-paid-millions-to-get-their-data-back-but-forgot-to-do-one-thing-so-the-hackers-came-back-again\/","name":"Ransomware: A company paid millions to get their data back, but forgot to do one thing. So the hackers came back again 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/ransomware-a-company-paid-millions-to-get-their-data-back-but-forgot-to-do-one-thing-so-the-hackers-came-back-again\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/ransomware-a-company-paid-millions-to-get-their-data-back-but-forgot-to-do-one-thing-so-the-hackers-came-back-again\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2021\/04\/ransomware-a-company-paid-millions-to-get-their-data-back-but-forgot-to-do-one-thing-so-the-hackers-came-back-again.jpg","datePublished":"2021-04-05T12:05:00+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/ransomware-a-company-paid-millions-to-get-their-data-back-but-forgot-to-do-one-thing-so-the-hackers-came-back-again\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/ransomware-a-company-paid-millions-to-get-their-data-back-but-forgot-to-do-one-thing-so-the-hackers-came-back-again\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/ransomware-a-company-paid-millions-to-get-their-data-back-but-forgot-to-do-one-thing-so-the-hackers-came-back-again\/#primaryimage","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2021\/04\/ransomware-a-company-paid-millions-to-get-their-data-back-but-forgot-to-do-one-thing-so-the-hackers-came-back-again.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2021\/04\/ransomware-a-company-paid-millions-to-get-their-data-back-but-forgot-to-do-one-thing-so-the-hackers-came-back-again.jpg","width":770,"height":578},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/ransomware-a-company-paid-millions-to-get-their-data-back-but-forgot-to-do-one-thing-so-the-hackers-came-back-again\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Ransomware: A company paid millions to get their data back, but forgot to do one thing. So the hackers came back again"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/40302","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=40302"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/40302\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media\/40303"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=40302"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=40302"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=40302"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}