British Library begins contacting customers as Rhysida leaks data dump

The Rhysida ransomware group has published most of the data it claimed to have stolen from the British Library a month after the attack was disclosed. Infosec experts originally speculated that the group may not have stolen much in the way of data, but the creator of Have I Been Pwned?, Tory Hunt, said the dump "looks rather …

[sten2012]

From the previous article on this topic:

> The criminals said there will be only one single-party winner that will be the sole recipient of the stolen data.

That to me strongly says the data won't be broken up. It's bought, or not.

Yet now:

> "Not-sold data was uploaded, data hunters, enjoy."

While I don't trust ransomware operators, obviously, their word is quite important to their business model. Under wild speculation here - was a ransom partially paid so it never ended up under auction?

Or was it just a lie?

[Richard 12]

More likely, nobody paid at all.

[sten2012]

I probably should have quoted more, but it wasn't all released. With the vague implication being 10% had been sold.

I guess maybe they list separately credentials via access brokers and any card information via carding sites if it doesn't sell, but 10% sounds a LOT for just those. But I guess I'm mostly just curious what the 10% being withheld is, and why, and if paid for - by whom and for what purpose. Questions I can never find out the answer to!

[LessWileyCoyote]

Sorry to nitpick a typo - Troy Hunt, not Tory Hunt.

[Phones Sheridan]

<Lee Mack> What did you just call me???! </Lee Mack>