A Hacker Gang Was Trying to Extort D.C. Police for $4 Million

A ransomware gang, Babuk Locker, has been attempting to extort the Metropolitan Police Department in Washington D.C. for $4 million, but negotiations between the cops and the criminals recently collapsed, leaked documents appear to show.

Several weeks ago, the cybercriminal group announced that it had stolen the MPD’s data—some 250GB that included thousands of pages of sensitive internal documents, including disciplinary files on officers, and intelligence on local gang activity and informant programs. The police department later confirmed that it had been hacked.

Since then, Babuk has been attempting to extort the agency, threatening to leak sensitive internal documents if cops did not pay them. About two weeks ago, the gang leaked a limited amount of data to the web, publishing personnel files on a select number of current or former MPD officers.

On Tuesday, an apparent communication breakdown between both groups resulted in a much larger tranche of the MPD’s data being leaked to the web, a 22.7GB file.

In a statement posted to their leak site, the criminals said:

“The negotiations reached a dead end, the amount we were offered does not suit us, we are posting 20 more personal files on officers, you can download this archive, the password will be released tomorrow. if during tomorrow they do not raise the price, we will release all the data.”

The criminals also posted screenshots of what appear to be conversations between themselves and police, giving an apparent window into how ransom negotiations went. The screenshots show that the hackers asked for $4 million in exchange for the data, but police claimed they were only willing to pay $100,000.

At one point, Babuk delivered a sober, dead-eyed address to the police department, claiming to only have monetary interests—not political ones. On April 28, the gang said:

BABUK: We want to inform you that we are not interested in the international politics and other issues between governments, conflicts, e.t.c. Our offer for you is to pay us for deletion of the information that we have collected plus we issue a warning statement on the website for other individuals not to intrude to the US government institutions. How does it sound to you?

After days of back and forth between the criminal group and the cops, the police negotiator seemed to signal a willingness to pay for the data, though not the allotted $4 million. A message dated May 10 goes as follows:

PD: Our proposal is an offer to pay $100,000 to prevent the release of the stolen data. If this offer is not acceptable, then it seems our conversation is complete. I think we both understand the consequences of not reaching an agreement. We are okay with that outcome.

BABUK: This is unacceptable on our side. Follow our web-site at midnight.

Not long after that, data from the police department began leaking out onto the group’s website. A spokesperson for the police department did not immediately return a request for comment from Gizmodo. We will update this story if we hear back.