“Some of the data it discovered on LockBit’s systems belonged to victims who had paid the ransom.”
LockBit promised to delete stolen data once a victim paid. The NCA found the paid victims’ data still sitting on LockBit’s servers. Operation Cronos seized the admin environment, recovered more than 1,000 decryption keys and led to four arrests. Every company that paid bought nothing but a promise from a criminal.