Dish Network, an American television provider, likely paid a ransom after it was attacked by ransomware in February, based on the wording used in data breach notification letters sent to affected employees.
While it did not directly confirm that it had paid, Dish implied this by saying that it “received confirmation that the exported data had been deleted.”.
Ransomware gangs only delete data or provide a decryption key after a ransom is paid, meaning it is highly unlikely that Dish would have received confirmation that the stolen data was deleted without paying.
Even if law enforcement were able to intercept the server hosting the data, there would be no way for them to know that a copy of the data had not also been stored elsewhere by the threat actors without paying a ransom.
Unfortunately, paying the ransom does not guarantee the complete deletion of stolen data. Previous incidents have shown that victims who paid the ransom were then subjected to further extortion weeks later, their data sold to other threat actors or leaked to data leakage websites.
BleepingComputer reached out to a Dish Network representative to confirm whether the ransom has been paid, but there was no immediate response.
No customer data was affected in the incident
The company also revealed in the notification letters that customer information was not compromised during the ransomware attack that hit its network in February.
However, Dish discovered that confidential files and sensitive information belonging to current and former employees, as well as their families, had been exposed during the breach.
Dish also notified the Maine Attorney General's Office that the data breach affected 296,851 people, with the exposed information including names and other personally identifiable information along with driver's license numbers.
Information source: bleepingcomputer.com
