Buy Me a Coffee

Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are impacting your business

Negotiation Chat – Pear

Chat ID: 20250720

Victim Avatar
Hello. I’m to negotiate on Case # GL57552. We finally made it here, please remove our name from your website so we can work this out.
2025-07-20
You had enough time to reach out in time and then your name would not appear on our website. But you’ve ignored the timeline. So, now your name will be taken down after we make a deal and you pay ONLY. There’s no other way at this point. No need saying anything about that anymore. Just hold on and we’ll provide you with the complete list of your files we have and with deal conditions soonest.
Gang Avatar
We have breached your systems and duplicated over 3.8 TB of your sensitive data to our servers. The link below contains the archive with the complete list of your files we have taken: Archive link - https://limewire.com/d/[Redacted] Archive password - 6rj75o1n_js^ Choose for up to 3 files from the list and send us the file names. We’ll send you those files back as proof of your data availability on our side. Conditions: (a) You have to pay us 4 BTC to save your data from leaked and avoid any additional damages possible; (b) We will provide you with our bitcoin address immediately after you confirm a deal and ready to proceed with the payment; (c) We set Wednesday, July 30, as the deadline for the payment to be completed; (d) You’d better stay online and be in touch with us daily within all this time. Otherwise, we will find your silence as declining a deal and will follow to harassing you, your staff, partners, and all other parties affected whose contacts we have on your files; (e) We will start leaking your files since Thursday, July 31, if we don’t get paid by that time. What you get if we are paid: (a) All your data we have will be permanently removed from our servers; (b) You will be provided with deletion proof; (c) We will take your name down from our website and will not ever spread a word related to this incident; (d) We will not ever leak, use, sell, or share with third parties even a file of your data; (e) We will not attack your company again.
Gang Avatar
Here’s our website mirror link in case you can’t access it with the first one http://pear...3rmtqd.onion The deadline we’ve set is more than adequate. But you don’t have too much time to waste it. You’ve lost Monday. When will you request for 3 files?
2025-07-22
Gang Avatar
Victim Avatar
This has all been very overwhelming, and we’d really appreciate some time to review everything you’ve sent us. We’re committed to finding a way forward. Please reconsider taking our name down from your website — this is the first real opportunity we’ve had to reach out. It’s been quite hectic on our end, and as you can imagine, we’ve been juggling a lot. We’ll choose the files asap.
Please reconsider taking our name down from your website Unfortunately, this is non-negotiable at this point. It will be taken down immediately after the deal is closed. Don’t worry, we will not post anything else anywhere or any of your files within the timeline set.
Gang Avatar
We’d really appreciate some time to review everything you’ve sent us You are aware of the deadline. You’d better request for any 3 files soonest for we could move forward. You may continue reviewing the listing even after files requested. But have no doubt that each file on the list is yours. More over, we are investigating your files on our side, as well. And we’ll provide you with some proof of your data we have is sensitive. Some of it is extremely sensitive.
Gang Avatar
Victim Avatar
It’s unfortunate that our name is still on your website, especially as we’ve been cooperating. We hope you’ll reconsider. In the meantime, here are the files we’re requesting back: [Redacted].jpeg [Redacted].jpeg [Redacted].pdf
2025-07-23
Here are your files: Archive Link - https://limewire.com/d/[Redacted] Archive Password - 7o6iFf(sT)8pFGW32q4Y You had enough time to reach out in time and then your name would not appear on our website. But you’ve ignored the timeline. So, now your name will be taken down after we make a deal and you pay ONLY. There’s no other way at this point. No need saying anything about that anymore. Unfortunately, this is non-negotiable at this point. It will be taken down immediately after the deal is closed. Don’t make us repeat same things again and again. Your name up on our website is your fault only. You have to be active and strictly constructive. The soonest you pay - the soonest your name will be taken down.
Gang Avatar
Victim Avatar
It’s not that we’re ignoring the timeline, it’s just that your expectations may be a little off. We’re doing everything we can to move as quickly as possible, but it’s hectic on our end. We’ll get leadership to review the files and confirm they’re ours, then follow up. In the meantime, how flexible are you on the price?
2025-07-24
It depends on whether you are able to make payment by the end of this week or not. If so, we agree to negotiate on the price.
Gang Avatar
Victim Avatar
You mentioned a deadline of next week, is that still the case? There’s no way we can pay nearly a half a million dollars, especially not by the end of this week. What kind of discounted price could you offer us?
is that still the case? Sure Well, a 10% discount is not a problem. We can deal at 3.6 BTC
Gang Avatar
Hello? Near Wednesday the deadline comes. What you stall for?
2025-07-25
Gang Avatar
Victim Avatar
Bitcoin is a bit too hectic for us, can you just give us a price in dollars? Is 10% the best you can do on the discount? You also mentioned you’d be sending over some sensitive files you have from us, we’re still waiting on those.
3.6 btc makes it $420,000 at the moment.
Gang Avatar
Is 10% the best you can do on the discount? you’d be sending over some sensitive files you have from us You could request for absolutely any files from the file tree. You’ve chosen and requested. And we’ve sent them back to you. You know well what information your files contain. Your files we have I mean. So, we do not understand clearly what exactly you want at the moment. An additional discount to be provided for reaching an agreement shortly without waiting until the deadline comes? Or us demonstrating you real sensitivity of your files and no more discounts further? Or you doubt about all the files from the list are in our possession?
Gang Avatar
??
Gang Avatar
You are not active enough guys. That may bring you to irreparable consequences. But ok. Let’s start with the light one Archive link - https://ufile.io/[Redacted] Archive password - lr#s$XC/plcuCWQ#24d Say ‘Hello’ to [Redacted] So, would you like us to search something that kind among your multiple cases’ exhibits and evidences? Or will we move to reaching and closing a deal?
Gang Avatar
Why haven’t you replied yesterday? Only 3 business days ahead you have. What you say?
2025-07-26
Gang Avatar
Victim Avatar
We can’t seem to download that file. As for the price, we still do not have the means to pay that amount. As for our responses, we can’t sit here 24/7 and with it being the weekend, we can’t collect anything. We need to re group on Monday and see where the larger group stands. One thing the partners have requested is the ability to request a few more files from the list. We are hoping to have those file names for you by Monday.
https://ufile.io/[Redacted] The link is valid and works properly. I’ve checked it right now. What’s your problem downloading the file? Looks like bluff.
Gang Avatar
Try this link: https://limewire.com/d[Redacted] Same archive password Archive password - lr#s$XC/plcuCWQ#24d
Gang Avatar
We still do not have the means to pay that amount Don’t you?
Gang Avatar
The archive below contains samples of different types of data on your files we have. Take a look: Archive Link - https://limewire.com/d[Redacted] Archive Password - E%`YfR6d#79*}Ghi Each folder contains 2/3 files. [Redacted] [Redacted] [Redacted] [Redacted] [Redacted]
2025-07-27
Gang Avatar
Victim Avatar
We still do not have the means to pay that amount
partners have requested is the ability to request a few more Do you really think they need to request for additional files? We don’t think so. That makes no sense doing that when 3 days left before deadline comes. We can provide you with a couple more files, for sure. But what firm’s owners need indeed is to start collecting money to make the payment if they want to avoid their data and reputation leaked.
Gang Avatar
Victim Avatar
They would still like to request more random files from the list. As for the deadline, you’re asking us for nearly half a million dollars. We are a fairly small firm compared to most and raising that amount is impossible. We understand the seriousness information you have but we’re still hoping you will lower the price to something more reasonable and affordable. As I mentioned before, we will be meeting Monday and should have some more file names for you then.
We find this simple stalling and nothing else. You already have proof provided and know well that all the files from the list are available on our side. But ok, we said we can and we’ll do. We allow you to request for 3 more files but no more further and today only.
2025-07-28
Gang Avatar
1. You are saying about the price according to firm’s financials only. But you are not saying a word about penalties and fines possible if we leak their data. Hundred thousand or even millions USD under HIPAA only. But if class action claim will take place firm will suffer in millions for sure. We understand the price set doesn’t make anyone happy on your side. We have a lot of firm’s financial files through years and understand best what they can afford after seeing some samples. Archive Link - https://limewire.com/d/[Redacted] Archive Password - DscTVGg6{hp7Bujj But the incident took place is firm’s fault only. They’ve neglected taking proper measures on systems security and grossly violated sensitive data storage conditions. 2. We see you will not be able to complete the payment by Wednesday. You’ve lost too much time saying anything but nothing constructive for reaching a deal. So, looking ahead we move the timeline. Near Wednesday is still the deadline for you confirmed a deal. Near Friday - for payment completed. Samples of your sensitive data will be posted on our website near Thursday if we don’t shake hands by that time. 3. Over a week since we are negotiating here with you. And still nothing constructive from you we see. You (you personally, we mean) saying ‘we’ as if you are part of [Redacted]. You are not and we understand that clearly. You are either the insurer’s employee, or an external negotiator hired by their insurers. That’s why you are not active enough and always reply once a day only. You don’t really care about [Redacted]'s firm. What you’re doing is try make a solid discount and nothing else. The point you may bring them to irreparable consequences doesn’t touch you. So, we will send the complete log of this negotiation to all [Redacted] partners if you bring their data to leaked. Let’s just do business and figure out this. We will make a solid discount step and set the price at $370,000. Do you confirm?
Gang Avatar
Victim Avatar
Let’s take this one step at a time. We’re actively working to find the funds to increase our offer to you, and that takes effort and time — so please bear with us. We’re very grateful for the discount, and we’ll be discussing it with the rest of the team. In the meantime, here are the additional 3 files we’re requesting: [Redacted].docx [Redacted].docx [Redacted].pdf
2025-07-29
to increase our offer to you, What’s wrong with you??? You haven’t offered even anything. What are you talking about? We allow you to request for 3 more files but no more further and today only. You’ve ignored this. So, you’ve lost your chance. Looks like you find it a game. Well, even if it is - we set rules. We will not provide you with any more files you request. But we will now send you some more files we’ve picked while investigating your data. Just hold on for a while.
Gang Avatar
You have to see this: Archive link - https://limewire.com/d/[Redacted] Archive Password - D%6^*fewq@53sae4S You will be able to verify each file from the list after we publish your data on our website. That will happen if you continue same way. Tomorrow evening is latest you have to confirm a deal. No more time extensions will be provided to you.
Gang Avatar
after we publish your data [Redacted] firm’s data we meant.
Gang Avatar
Do you confirm a deal?
2025-07-30
Gang Avatar
And one more point. Here’s another pack of GLW’s files in the archive below: Archive Link - https://limewire.com/d/[Redacted] Archive Password - dY%6$#WGJ0(jW5d1vQ These are some password encrypted files we’ve found while investigating. We’ve decrypted them. Here are passwords: [Redacted].xlsx [Redacted] [Redacted].xlsx [Redacted] [Redacted].pdf [Redacted] [Redacted].pdf [Redacted] [Redacted]
2025-07-31
Gang Avatar
So, none information will be saved after leaked. You weird man. GLF’s ship is going down. 1 pm today we’ll send screenshots of this conversation to [Redacted], [Redacted], [Redacted], [Redacted], and [Redacted]. They will be delivered, have no doubt. We want them to know your actions bringing their data to leaked. 5 pm today samples of GLF’s sensitive data will be posted on our website. This will be leakage beginning. We always do what we say. So, we’ll do what we have to do. You have timelines.
Gang Avatar
Victim Avatar
Do you have the files we requested? If you want us to confirm a deal with you we need to see the files. There’s no reason to rush us this much, we’re cooperating. Just please give us some more time while we work things with you and try to figure out the financial side of things.
[Redacted].docx Files with this name are in folders with cases of 3 your clients: [Redacted] [Redacted] [Redacted] Which folder would you like us to take it from?
Gang Avatar
Victim Avatar
[Redacted] We’ll take from here
we need to see the files. Here they are: http://peargxn3oki34c4savcbcfqofjjwjnnyrlrbszfv6ujlx36mhrh57did.onion/Companies/[Redacted]/ and mirror link http://pear...3rmtqd.onion/Companies/[Redacted]/ Use the Tor browser to follow links above Near Monday we’ll post samples of your files we’ve been sending you before in archives. On Tuesday we’ll publish all your data we have. We set the lowest price at $270,000 to settle the incident.
Gang Avatar
Victim Avatar
Since you chose to post our name and files on your website, we have no choice but to part ways effective immediately. It’s unfortunate we couldn’t reach a resolution, but sometimes things end this way. We’re moving on and hope you do the same. This will be our final message. Goodbye.
2025-08-01