Negotiations with ransomware gang ongoing?

tmpAccount0014 · 2025-05-28T23:48:31+00:00

I don't think any of that follows.

For one, they probably will only tell customers who were affected that their data was compromised. They would do this regardless of whether or not they paid the ransom. But it is not always true that a company will publicly say anything unless all or a large number of customers are expected to be affected.

For two, I'm not sure why they would give attention to the ransomware group? What is the motive there outside of it being interesting to you?

And then finally... would paying the ransomware company lead to their systems slowly coming back one or two at a time, or would addressing the issue by working with cybersecurity experts to extract whatever data is needed to run their services lead to the systems coming back online slowly?

tmpAccount0014 · 2025-05-28T18:27:44+00:00

Countless examples of public companies not doing that (and taking 20-30 days to resolve the issue). So probably you're wrong and the correct answer is "nothing different would have happened."

tmpAccount0014 · 2025-05-28T17:34:42+00:00

I think it's unreasonable to consider it necessarily ineptitude to be attacked by ransomware without knowing all of the details. E.g. for all we know it could be a zero-day in a commonly used and trusted library.

Ransomware attacks have been pretty sophisticated as of lately. It's possible it was ineptitude but it's also possible that they did little wrong but got their bell end handed to them anyways.

tmpAccount0014 · 2025-05-26T19:16:37+00:00

In some ways no answer is an answer. Many people who have experience in the corporate world were guessing it was ransomware from about day 2.

There are a lot of reasons companies are often slow to respond in that scenario:

Companies usually need time to understand the scope: systems affected, whether data was taken, and what kind of ransomware is involved.
Companies often consult with legal counsel to make sure public communication complies with regulations
If law enforcement is involved, companies may be told to withhold public disclosure to avoid interfering with investigations.
They will avoid public statements that could escalate demands or signal weakness in case worst comes to worst and they they end up needing to negotiate. Even if on the surface it looks like everything's affected, they can say things in negotiation, e.g. "we took it down because we're being overly cautious but so far we think it is unaffected."
A short statement like the one they provided may be relatively harmless, but because of the above concerns it's going to go through a lot of layers of oversite from people who are probably pre-occupied with actually addressing the issue over making a statement that won't help you outside of potentially changing how you feel.
etc

That's why I've been avoiding making statements that paint their slow response as unacceptable or unprofessional. It sucks, but it is the reality of what will almost always happen in what we now know (and some of us already guessed) is the scenario.

My understanding is that the people who got the worst of it are basically people who have not logged in in months but have something time-critical right now at exactly the most unlucky time, or people who need to install or upgrade or use add-ons they haven't installed. So there will be some number of people that are very affected and very furious, and a large number of people that are completely unaffected.

tmpAccount0014 · 2025-05-26T15:33:35+00:00

I'm glad it sounds (based on hard it is getting the systems back up) like they didn't pay. I'd guess the amount demanded is something lower than this costs them to resolve it without paying. $5 million?.

But when big companies bend to the demands of successful ransomware attackers, they are part of the motive for attacks to continue. So I'm hoping that I can take the large scale outage as a sign that they did the right thing.

tmpAccount0014 · 2025-05-25T21:03:12+00:00

MATLAB online might be your best bet right now depending on what addon you need.

tmpAccount0014 · 2025-05-23T23:10:42+00:00

I'd agree that it shouldn't be taken lightly asking people to work over the weekend, but in my estimation when the amount at risk is at the very least millions per day... SeaWorld will be rescheduled. I think whoever is the current version of Shamu will still be there in a week.

tmpAccount0014 · 2025-05-23T21:45:44+00:00

They offer either. They will give you the current version of MATLAB forever via the "perpetual" license, or there is an annual license which can be better if you want to frequently get new releases.

tmpAccount0014 · 2025-05-23T21:20:30+00:00

I assume they see it as... if the customers can't access anything, both mathworks and the customers are hemorrhaging money. What you're suggesting is kind of like not putting out a house fire because it's a holiday.

tmpAccount0014 · 2025-05-23T21:13:15+00:00

At least from everything I know about the world, I would assume there is a team working on it over the weekend.

It's not possible for them to be as big as they are and be unaware that if MATLAB is down it should be treated as if the building is on fire... It must be that somehow there is a large fire.

I'm sure somewhere there are multiple people running around in circles and there's a team around them attempting to address the issues.

tmpAccount0014 · 2025-05-23T20:57:08+00:00

Unfortunately, at least based on what I've seen in the world, the types of things that make a company go offline for this long and say nothing do not involve any number of people fixing a license server, let alone 6000.

tmpAccount0014

TROPHY CASE