New criminal service plans to monetize data stolen by ransomware gangs

I don’t actually see huge criminal monetization risks from personal data in this context,” said Jamie MacColl, a researcher at the Royal United Services Institute who in 2024 published a paper detailing ransomware harms. “Attackers are much more interested in corporate data, things they can use for extortion or to gain access to other systems.” That preference reflects the underlying economics of ransomware. Rather than extracting maximum value from each dataset, most groups operate on volume, targeting large numbers of victims and accepting that only a fraction will pay. “It’s about achieving scale and having access to enough victims,” MacColl said. “They operate on the basis that they won’t succeed every time, but if they succeed 20 percent of the time, that’s still tens of millions of dollars.” “It just doesn’t really fit with the operating model to spend time analyzing individual datasets in depth,” he added.