The Receipt You Thought Was Private: What a Criminal Feud Means for Companies That Paid

Every ransom payment decision rests on an assumption nobody writes down: this stays between us and the criminals. The data gets "deleted." The payment stays quiet. The board is briefed once, the insurer is notified, and the incident becomes a line in a closed file.

This week, two criminal groups showed exactly how fragile that assumption is.

What happened

Beginning on the night of Friday, September 18, the extortion group ShinyHunters hijacked the dark web leak site run by Clop (also written Cl0p), one of the most prolific ransomware operations of recent years. Clop has used that site for years to name victims and pressure them into paying. This time, the site was used against Clop itself.

According to BleepingComputer, which first reported the breach, ShinyHunters claims it got in through an unauthenticated file upload flaw in the content management software running Clop's site. BleepingComputer independently confirmed the defacement. It has not verified ShinyHunters' further claims that it stole server logs, source code, and the private keys that control Clop's dark web address.

Then came the demand. ShinyHunters posted an unspecified eight-figure extortion demand against Clop, said the amount would rise every 24 hours, and later added a demand for a public apology. The line that should get every board's attention was reported by Dark Reading: ShinyHunters threatened to start "releasing information regarding the companies that paid you, how much, and to what Bitcoin address."

The companies in question are those caught up in Clop's campaign against Oracle E-Business Suite. In October 2025, Oracle issued an emergency patch for CVE-2025-61882, a critical flaw (rated 9.8 out of 10) that let attackers take over E-Business Suite servers without a password. Clop used it to steal data and extort organizations. CISA added it to its list of actively exploited vulnerabilities.

A caution before going further: ShinyHunters has not shown proof that it holds any information about Clop's victims. These are claims from a criminal group in the middle of a public feud. But you don't need the threat to be real for the lesson to be real.

The lesson: stolen data doesn't retire

Jon Baker of AttackIQ put it plainly to Dark Reading: "stolen information doesn't retire." Every copy of your stolen data sits on infrastructure run by criminals, their affiliates, and their hosting providers. Each copy is another chance for theft, resale, or exposure.

Think about what that means for a company that paid.

Paying for deletion was always a bet on the honesty of people whose business is theft. Now add a second layer: even if the original group kept its word, its own systems can be breached. Your data, your negotiation transcripts, your payment amount, and your wallet address are only as secure as a ransomware gang's IT department. As this week showed, that department is running unpatched software like everyone else.

Why this is a board problem, not an IT problem

A ransom payment is not a technical decision. It's a business decision with legal, reputational, and regulatory consequences that outlive the incident. This feud exposes three of them.

First, the disclosure you made is now testable. If your company paid, what did you tell regulators, investors, customers, and your own board? If a criminal publishes a list of payers with amounts and wallet addresses, every public statement you made about that incident will be compared against it. A gap between "we're investigating" and, say, a seven-figure payment made three weeks later is not a security problem. It's a credibility and, potentially, a liability problem.

Second, the payment itself carries legal exposure. In September 2021, the Treasury Department's Office of Foreign Assets Control (OFAC) warned that facilitating ransomware payments can carry sanctions risk, and that it would consider things like reporting to law enforcement and strong security practices as mitigating factors. A published record of who paid, and to which wallet, is exactly the kind of evidence that makes that risk concrete.

Third, you may be extorted twice for one breach. Dark Reading noted that if ShinyHunters did obtain Clop victim data, those organizations could face renewed extortion. Your incident response plan probably ends when the first incident closes. It probably doesn't account for a second criminal walking in with your data and your payment history.

The Three Questions, applied

In Cyber Risk Is Business Risk, I argue that boards don't need to understand the technology to govern the risk. They need to ask the right questions and insist on straight answers. Here's how the Three Questions apply this week:

1. What are we actually protecting, and where does it live now? For any past incident involving data theft, the honest answer includes "copies we no longer control." Does your risk register treat stolen data as a closed item or as a continuing exposure?

2. Who decides whether we pay, and on what basis? If the answer is "we'd figure it out in the moment," that's the answer to fix. The payment decision, the legal review, the OFAC check, and the disclosure plan should be settled before the crisis, with the board's role written down.

3. Would our public statements survive the criminals' version of events? Assume anything you told an attacker will eventually be public. Does what you told everyone else still hold up?

This is the gap between compliance and security I keep coming back to. A company can meet every notification deadline and still be badly exposed, because compliance measures what you disclosed on schedule. Risk is measured by what someone else can prove later.

What to ask your CISO this week

• Were we on Clop's list? Did we run Oracle E-Business Suite in 2025, and did we receive an extortion email during that campaign? If so, what did we do, and who approved it?
• Is our ransomware payment policy written and board-approved? Does it include a sanctions screening step and a law-enforcement reporting step?
• Do we track stolen data after an incident closes? Who monitors for it resurfacing on leak sites or criminal forums?
• Does our incident response plan cover a second extortion attempt using data from a prior breach?
• Do our past incident disclosures match our internal records? Ask general counsel to review them with the assumption that the attacker's records could become public.

The bottom line

Criminals fighting each other can look like good news. As Malwarebytes' Pieter Arntz noted, while they're busy with each other they probably have less time for legitimate businesses. But the bigger signal is what the fight reveals: the "deal" you make with an extortionist is stored on their servers, protected by their security, and governed by their loyalties. None of those is a control you own.

Govern accordingly.