{ "chat_id": "0E1263992076698458ABCB025007C6FF", "messages": [ { "party": "Victim", "content": "[Chat started]", "timestamp": "24.08.2022 09:17:17 UTC" }, { "party": "Victim", "content": "Bonjour, nous \nprenons s\u00e9rieusement en compte votre attaque sur notre \u00e9tablissement. \nQui \u00eates vous? et qu'est-ce que voulez vraiment \u00e0 faire ce que vous \nfaites?", "timestamp": "24.08.2022 15:20:27 UTC" }, { "party": "LockBit 3.0", "content": "Welcome. Your Servers have been \nencrypted by us. To decipher and restore the functionality of your \nnetwork, you have to pay us $1,000,000 in Bitcoin. Additionally I \ninform you that we have about a million files from your servers \nconcerning your patients. As well as contracts with partners and \nconfidential agreements. Medical histories, doctor's appointments, \nprescriptions, ultrasound images, and personal data. In the event that \nyou do not pay the ransom, this data will be published in our public \nblog. The amount of $ 1,000,000 is not big for your company. We did not \n put a high price, because we respect health care. We offer to solve \neverything quickly and without too much noise. You pay, we give you a \ndecryptor and destroy your data from our servers", "timestamp": "25.08.2022 01:49:32 UTC" }, { "party": "Victim", "content": "Savez-vous \nr\u00e9ellement qui vous avez attaqu\u00e9? et les cons\u00e9quences actuelles et \nfutures que cela peut avoir pour nous, pour les personnes de notre \n\u00e9tablissement, pour vous? Nous vous demandons de nous donner maintenant \nles clefs de d\u00e9chiffrement s'il vous plait et de stopper votre attaque \ninhumaine.", "timestamp": "25.08.2022 07:17:23 UTC" }, { "party": "LockBit 3.0", "content": "We know you're a commercial company. \nWhich makes money. Your company's revenue is over seven hundred million\n dollars. You can stop the attack and be calm by paying just one \nmillion dollars. In case of refusal, we will take further pressure \nsteps. We will contact your partners. Let's lay out some of the data \nabout your patients. Info about covid vaccination. Covid passports. And\n the price can be increased.", "timestamp": "25.08.2022 07:48:13 UTC" }, { "party": "Victim", "content": "Je suis surpris\n de voir que vous ne savez pas du tout qui nous sommes r\u00e9ellement! Nous \nsommes un h\u00f4pital public. Avec tout ce que cela entra\u00eene comme pauvres \nmoyens; financiers, mat\u00e9riels et en personnels. Je vous laisse en juger\n par vous-m\u00eame avec les liens ci-dessous et je vous demande encore une \nfois de stopper votre attaque meurtri\u00e8re s'il vous plait, en nous \ndonnant maintenant les clefs de d\u00e9chiffrement. Merci", "timestamp": "25.08.2022 11:24:55 UTC" }, { "party": "Victim", "content": "https://twitter.com/BFMParis/status/1561970373314347008", "timestamp": "25.08.2022 11:25:19 UTC" }, { "party": "Victim", "content": "https://twitter.com/CHSF91/status/1561762193980661760", "timestamp": "25.08.2022 11:25:30 UTC" }, { "party": "Victim", "content": "https://www.reassurez-moi.fr/guide/mutuelle-sante/hopital-prive", "timestamp": "25.08.2022 11:26:02 UTC" }, { "party": "LockBit 3.0", "content": "https://www.zoominfo.com/c/centre-hospitalier-sud-francilien/426480031", "timestamp": "25.08.2022 12:24:05 UTC" }, { "party": "LockBit 3.0", "content": "You already losemore then 50ml revenue. You have only one way. Pay us fast to stop this. Or price can be increased.", "timestamp": "25.08.2022 12:26:12 UTC" }, { "party": "LockBit 3.0", "content": "We strongly advise you to complete your\n transaction with us as soon as possible. As soon as we receive payment \nwe will immediately give you a decryptor. And the attack will be \nstopped. And the details of your partners and clients will not be made \npublic. That's the only way. Nothing personal. Simple business.", "timestamp": "25.08.2022 12:54:06 UTC" }, { "party": "Victim", "content": "Je pense que \nvous savez, avec ce que vous d\u00e9tenez et que vous comprenez que c'est \nimpossible pour nous de payer la somme demand\u00e9e. ET je ne comprends pas \nvotre comportement, o\u00f9 sont donc pass\u00e9es vos valeurs? votre \u00e9thique?", "timestamp": "25.08.2022 16:41:48 UTC" }, { "party": "Victim", "content": "https://medium.com/s2wblog/evolution-of-lockbit-to-3-0-e21386188b65", "timestamp": "25.08.2022 16:43:11 UTC" }, { "party": "LockBit 3.0", "content": "Je pense que vous savez, avec ce que \nvous d\u00e9tenez et que vous comprenez que c'est impossible pour nous de \npayer la somme demand\u00e9e >>> Find the way to solve this problem.\n Every day you lose your money clients and reputation. That is why to \nsolve this problem in your best interest je ne comprends pas votre \ncomportement, o\u00f9 sont donc pass\u00e9es vos valeurs? votre \u00e9thique? \n>>>You get the money from your clients you do not anythink \nFREE! Now you face with our world reality. Next time pay attention your \ninternet security", "timestamp": "25.08.2022 17:50:07 UTC" }, { "party": "LockBit 3.0", "content": "Since we do not yet see from you an \nadequate attitude to the situation and readiness to pay. We will begin \nto prepare letters for your clients and partners. And also we will begin\n to prepare a public blog for your company. We have a lot of your \ninteresting date. Including also correspondence from mail servers. We \ngive you time until 30.08 inclusive. In order to settle everything \nquickly and quietly. If by this time we don't start talking about \npayment. Then we will be forced to act further.", "timestamp": "26.08.2022 07:24:14 UTC" }, { "party": "LockBit 3.0", "content": "fr.jpg\n0.97MB\n", "timestamp": "26.08.2022 07:40:28 UTC" }, { "party": "LockBit 3.0", "content": "Just look at this. Its only for u. For exemple.", "timestamp": "26.08.2022 07:41:12 UTC" }, { "party": "Victim", "content": "Donc en r\u00e9sum\u00e9,\n si je comprends bien, tout ce que vous voulez c'est votre argent? M\u00eame \nsi cela peut entra\u00eener la mort de patients de notre \u00e9tablissement?", "timestamp": "26.08.2022 13:51:27 UTC" }, { "party": "LockBit 3.0", "content": "We know your situation no one of your \npacient will not die, all what you want to restore your data and do not \nhave data leak you have to pay money for this", "timestamp": "26.08.2022 14:30:48 UTC" }, { "party": "LockBit 3.0", "content": "Looking at our communication,we \nconclude that we are reaching a dead end. If we do not come to agreement\n to wensday we start making a public blog with your stolen data", "timestamp": "26.08.2022 14:36:36 UTC" }, { "party": "Victim", "content": "Ok nous \ncomprenons votre volont\u00e9 et nous souhaitons coop\u00e9rer pour que tout se \npasse bien pour nous. Nous avons essay\u00e9 de vous transmettre des fichiers\n sur votre site mais ils sont trop lourd.", "timestamp": "27.08.2022 07:12:24 UTC" }, { "party": "Victim", "content": "Votre attaque a\n directement atteint nos outils de virtualisations. Je ne peux pas vous \nenvoyer de fichier. Les seuls fichiers que nous avons d\u00e9passent les 50 \nkb. Dans quelle mesure vous pouvez nous d\u00e9crypter un fichier vmdk pour \npreuve que vous \u00eates en mesure de nous aider? De plus nous n'avons pas \nacc\u00e8s aux donn\u00e9es de nos NAS.", "timestamp": "27.08.2022 07:12:53 UTC" }, { "party": "Victim", "content": "https://transfert-my-files.com/files/?file=i-X7YvRvWLRmz", "timestamp": "27.08.2022 07:13:31 UTC" }, { "party": "LockBit 3.0", "content": "Welcome. To decrypt this file, we will \nneed to wait for a technician. Decoding of small files is possible in \nautomatic mode. Try to find a file of the desired size on your NAS. You \nshould definitely have them there. After payment, you get a decryptor \nfor all your files. Including your NAS and your virtual machines. We all\n want this case to end quickly and quietly. You can also find out \ninformation about us on the Internet. The companies we work with always \nget what they pay for.", "timestamp": "27.08.2022 08:37:14 UTC" }, { "party": "LockBit 3.0", "content": "https://tempsend.com/afgxk", "timestamp": "27.08.2022 15:41:06 UTC" }, { "party": "LockBit 3.0", "content": "Btw if you will not pay 1 000 000 usd till 30.08 the price will be 10 000 000 usd as in your public statement", "timestamp": "27.08.2022 15:41:24 UTC" }, { "party": "LockBit 3.0", "content": "bc1qwwym65pfw864lmt9e6v3f5hv08p4v4yqp49fsn you have to pay test payment to this btc adress", "timestamp": "27.08.2022 17:17:41 UTC" }, { "party": "LockBit 3.0", "content": "1 $", "timestamp": "27.08.2022 17:18:16 UTC" }, { "party": "Victim", "content": "Ok nous \ncomprenons, nous souhaitons \u00e9galement que cela soit vite termin\u00e9. Nous \nvous remercions d'avoir compris notre situation et nous validons la \ntransaction comme vous l'avez \u00e9crit ci-dessus pour 1$ et selon les \nmodalit\u00e9s expliqu\u00e9es.", "timestamp": "27.08.2022 18:18:44 UTC" }, { "party": "Victim", "content": "Bonjour. Le d\u00e9lai approchant, nous nous permettons de vous relancer pour savoir o\u00f9 nous en sommes de nos \u00e9changes ?", "timestamp": "30.08.2022 07:37:59 UTC" }, { "party": "LockBit 3.0", "content": "Hello. Yes, your time comming to the end. Are you ready to pay?", "timestamp": "30.08.2022 07:41:11 UTC" }, { "party": "LockBit 3.0", "content": "We expect you to pay $1,000,000 in \nBitcoin (49 BTC) to the address above. After payment, you will receive a\n decryptor for all your files and virtual machines. We will also delete \nall information about customers and partners stolen from you from our \nservers after payment. Right now you have to make a test payment 1$ \nafter that you need write us.", "timestamp": "30.08.2022 08:04:09 UTC" }, { "party": "LockBit 3.0", "content": "bc1qwwym65pfw864lmt9e6v3f5hv08p4v4yqp49fsn", "timestamp": "30.08.2022 08:04:31 UTC" }, { "party": "LockBit 3.0", "content": "BTC adress", "timestamp": "30.08.2022 08:05:03 UTC" }, { "party": "Victim", "content": "Bonjour, ok \nnous sommes d'accord pour tout cela. Cependant nous serions rassur\u00e9s, \nn'ayant pas eu de vos nouvelles pendant plusieurs jours, si vous pouviez\n nous apporter la preuve de vos capacit\u00e9s \u00e0 nous aider. Cela m'aiderait\n \u00e0 convaincre ma direction pour proc\u00e9der \u00e0 la suite.", "timestamp": "31.08.2022 21:30:16 UTC" }, { "party": "Victim", "content": "https://transfert-my-files.com/files/?file=i-9hESKh9AfKT", "timestamp": "31.08.2022 21:30:55 UTC" }, { "party": "LockBit 3.0", "content": "Ok, wait.", "timestamp": "01.09.2022 09:58:06 UTC" }, { "party": "LockBit 3.0", "content": "1661980198_CHSFVW050-ctk.7z\n1.02kB", "timestamp": "01.09.2022 17:20:44 UTC" }, { "party": "LockBit 3.0", "content": "Welcome. During this time, we did not \nsee any test or main payment from you. We have provided you with all \nthe evidence that we can and are ready to help you. You received the \nfile. Talk to your boss. We need specific deadlines for receiving \npayments from you. In case you do not set us a deadline we will start \nmaking public blogs with your date. We will also continue to attack \nyour clinic. It's all dragging on for too long. Our boss is not happy \nwith this situation. If you do not solve it in the near future you will \nfeel serious consequences.", "timestamp": "02.09.2022 04:43:24 UTC" }, { "party": "LockBit 3.0", "content": "http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion/post/CcZwzmJObnllfPLb631894526d239", "timestamp": "07.09.2022 13:41:50 UTC" }, { "party": "LockBit 3.0", "content": "Now this blog is available for viewing \nonly for you! If you do not give an answer on the exact date of payment\n of the ransom, we will start mailing as well as calls to all partners, \npatients and employees, then the blog will become public.", "timestamp": "07.09.2022 13:42:15 UTC" } ] }