You Can't Buy Silence From People Who Keep Receipts

Twenty-seven firms reportedly paid to keep a breach quiet. Then the people they paid got breached.

That's the short version of the Silent Ransom Group leak. In early October, an archive of 5,692 internal chat messages from the crew also known as Luna Moth surfaced on an onion site and was first shared with DataBreaches. It covers August 2025 through the end of September 2026. Negotiations, access methods, target planning, members' spending. And a deal board.

Victims move across that board like leads in a CRM. Chat. Offer. Contract. Gold. Gold means paid.

By the group's own ledger, 27 organizations paid about $207 million between April 3 and September 24, 2026. Almost all of them law firms.

Coveware put it at the top of its Q3 2026 report, and the headline says the quiet part out loud: paying for silence fails. They also did something I've never seen them do. They opened with an open letter to senior partners at law firms, admitted they hate fear-based messaging, and used it anyway. Their forecast is that most of the Am Law 100 will be hit before this campaign winds down.

They're right. I'd push it one step further.

Silence was the product. The product leaked.

When you pay a data extortion crew, you aren't getting your data back. It's already gone. You're buying a promise not to publish it.

Think about what that promise is made of. A chat log with your firm's name in it. A negotiation history. A dollar figure. A wallet address. All of it sitting on infrastructure run by criminals, who now hold a second copy of your worst day, plus proof that you tried to hide it.

You don't control that copy. You never will.

So every firm that paid for discretion made a bet: that a criminal organization would stay secure longer than the firm's reputation matters. That bet was always bad. Now it's lost.

And this wasn't a freak event. Coveware said last quarter that outliers show up more often than even good advisors forecast. Criminal groups get burned by rivals, by disgruntled insiders, by researchers, by law enforcement. Conti's chats got dumped. LockBit's panel got dumped. Analysts have tied SRG to the remnants of Conti. Of course they leaked. That's what these outfits do.

If your incident is in their database, your incident is one leak away from the front page.

One honest caveat. The ledger is the group's own bookkeeping, and SRG denies the leak is real. Nobody has verified the $207 million. But it isn't fiction either. Chainalysis told The Register that some leaked wallets sit downstream of confirmed SRG ransom payments, including one member's wallet funded entirely by a victim payment north of $10 million. DataBreaches found that nine of the 27 named payers have disclosed incidents that line up in time. I'm not naming firms here. I don't need to. The existence of the ledger is the whole point.

Negotiating doesn't buy quiet either

The other myth in the room is that a quiet settlement is at least fast and cheap. The ledger says otherwise.

GuidePoint's analysis of the chats found that of 16 victims with more than one offer, 15 ended higher than they started. For victims with both an offer and a payment, the median jump from first offer to final payment was 5.5x, over a median of ten days. That isn't a negotiation. It's a ratchet.

Worse, simply engaging left a trail. DataBreaches found firms that made offers and still landed on SRG's leak site with notes that their offers were unacceptable. So the one thing the firm wanted most, nobody knowing, was traded away the moment it opened the chat window.

What paying actually changes

Very little. Coveware's numbers show nearly 80% of data-exfiltration-only incidents now resolve without a payment, and their reasoning is the reasoning I'd give any board. Paying rarely changes your legal notification obligations. Deletion can't be verified. Resale and re-extortion stay on the table.

Up here the math is the same. If personal information was taken and there's a real risk of significant harm, PIPEDA's breach rules don't care that a criminal promised to delete a folder. Neither do your clients, and neither does your law society.

Coveware's view is that these are legal, governance and communications crises, not technical events. Agree completely. Their prescription for firms already hit is transparent client communication. That's the only version of this story you get to write yourself.

The partner is the attack surface

Here's how SRG gets in. No zero-day. No firewall exploit. An email, then a phone call from someone claiming to be IT. A remote session gets approved. In some cases a hired "technician" walks into the office and copies files to a thumb drive. The leaked chats show field agents recruited off job boards and paid in crypto.

The FBI warned US law firms about exactly this in May 2025. It kept working anyway, because it targets people, not systems. Check Point counted 42 law firms among the group's 50 most recent victims, and S-RM puts law firms at roughly 78% of its known 2026 victims, per Cloudskope's roundup.

Coveware's line about the partner bio page stuck with me. That page hands an attacker a direct email, a direct line, a practice area and enough detail to sound credible on the phone. Across all their Q3 cases, phishing and social engineering were the top way in at about 29%.

Canadian firms shouldn't read this as an American problem. The ledger is mostly US names. Bay Street and Halifax firms share clients, matters and the exact same bio page template. The playbook doesn't need a passport.

What I'd do this month

None of this is expensive. Most of it is discipline.

Make hang-up-and-call-back the rule for partners and their assistants. Any unexpected IT contact gets verified through a known number, every time, no exceptions for seniority.

Nobody touches a partner's laptop in person without a ticket and a name the help desk can confirm. Block removable media on those machines while you're at it.

Block unapproved remote support and RMM tools. If a caller needs you to install something, that's your answer.

Look at your bio pages the way an attacker does. Route contact through a main line if you can live with it.

Decide your position on paying for silence now, in writing, while nobody's panicking. Draft the client notice before you need it.

GuidePoint landed in the same place: verification, physical access, removable media and leadership readiness are what move the needle against this crew.

Bottom line

Paying for silence assumes the criminal's records are safer than yours. They aren't. They never were.

You can't buy silence from people who keep receipts. Tell your clients before the criminals do, or before the criminals' own leakers do it for you.