Ransomware gangs are teaming up to extort victims through a shared data leak platform, and the exchange of tactics and intelligence. 

In November 2019, the Maze Ransomware operators transformed ransomware attacks into data breaches after they released unencrypted data of a victim who refused to pay.

Soon after, they launched a dedicated “Maze News” site used to shame their unpaid victims by publicly releasing stolen data.

Maze data leak site
Maze data leak site

This extortion tactic was quickly adopted by other groups, which now includes thirteen active ransomware operations known to leak stolen data if not paid.

Ransomware cartel formed

The Maze gang