extortion.wiki THE RANSOMWARE DOCUMENTARY ARCHIVE
Menu

242 negotiations · 332 notes · snapshots Jul 06, 2026 / Jun 26, 2026

lockbit3.0 — Chat: *************89AFE8

Date not recorded

From extortion.wiki, the ransomware negotiation research archive

A validated static rendering of 39 messages in source-array order. Transcript text is preserved without editorial additions.

Actor
lockbit3.0
Record date
Date not recorded
Messages
39
Participants
LockBit 3.0, Victim

Preserved messages

Actor / other Victim

Select a message number for a stable citation link. Text remains selectable; hard-wrapped source lines are joined for reading, intentional blank-line paragraph breaks remain, and written URLs remain inert.

  1. Message 001 From Victim Victim Date

    [Chat started]

  2. Message 002 From Victim Victim Date

    Hello we are writing you as you ask in your note. How do we get our files back?

  3. Message 003 From LockBit 3.0 Actor / other Date

    Hello. Please tell us your company name and confirm you are an official representative of the company.

  4. Message 004 From Victim Victim Date

    We are Wabtech, I am IT mgr with firm. Thank you.

  5. Message 005 From LockBit 3.0 Actor / other Date

    You must pay us to get your files back.

  6. Message 006 From Victim Victim Date

    How much are you asking for?

  7. Message 007 From LockBit 3.0 Actor / other Date

    $25 million for universal decryptor and destruction of stolen files.

  8. Message 008 From Victim Victim Date

    Hello, we moved to here as you asked.

  9. Message 009 From Victim Victim Date

    You mentioned you took out data, we need to understand that better. Please show us what you have taken so I can take this to the bosses. Thank you.

  10. Message 010 From LockBit 3.0 Actor / other Date

    https://temp.sh/ApbPz/wabtec_full.7z

  11. Message 011 From LockBit 3.0 Actor / other Date

    password = 5446731864718376751313472162

  12. Message 012 From Victim Victim Date

    Thank you for this. I will send this to our bosses for review.

  13. Message 013 From Victim Victim Date

    Our team and bosses are reviewing your large list. How much data is that? Also, would you kindly let us pick some files our of your list to ask for so we know you do indded have our data? Thank you.

  14. Message 014 From LockBit 3.0 Actor / other Date

    About 2 TB. Yes.

  15. Message 015 From Victim Victim Date

    Hello, can we please receive these files back from you?

  16. Message 016 From Victim Victim Date

    F:\wabtec\files\WCSSRV0453_Commercial_Functions\Commercial Functions\Marketing\Marketing Effectiveness\Training Conferences\What a Declining Business Media Means to CEOs.pdf F:\wabtec\files\CommercialKnowledgePortal\Commercial Knowledge Portal\Competitor Intelligence\CI at Tradeshows\2010 InnoTrans\InnoTrans 2010 Photos\Voith\Gravita Switcher\DSC01672.jpg F:\wabtec\files\CRDSRV0008_Documentation_and_Manuals\Documentation and Manuals\Vishay Strain Gauge Manuals\Vishay Micro Measurements\Vishay M-Line Accessories.pdf F:\wabtec\files\wcssrv036_RCV_Public_Drive\RCV_Public_Drive\SAFETY\Carson\Incident -Injury Forms\WGS SAFETY ALERT NOTICE TEMPLATE.docx F:\wabtec\files\LPZSRV0014_Technologie\Technologie\ToPs_Daten\Dokumente\LASER\DATEN\5185766_1.pdf F:\wabtec\files\VCISRV0028_Project_Engineering\Project Engineering\Engineering Administration\Policies, Procedures and Guidelines\Travel Policy\Wabtec Travel and Entertainment Policy - Final_2019-11-01.pdf F:\wabtec\files\WCTSRV0018\g\PLM\WTDSRV0014\projects\DenverP3_CP\1-56468_SLDPRT\D\whereused.pdmw F:\wabtec\files\WCMSRV0006_Pre-stagedData\Pre-stagedData\Completed Projects\QJHO01001-JohnHolland-Certification of Points\E - Engineering\E2 - Deliverables\CMC - Turnout Certification\Checksheets\03.05.2018 F:\wabtec\files\Departments_hr\HR\BENEFITS\WELLNESS 2016\Wabtec Online Store Flyer.docx F:\wabtec\Manufacturing\CAR projects\Wabtec QIP Assessment Info Request.xlsx F:\wabtec\files\WTDSRV0030_Materials\Materials\Packing Slips OSWH\2022\May 2022\5-23-22.pdf F:\wabtec\files\Finance1\turbo_LP\fixed assets\TNX\Tooling\50311 Balancing tool.pdf F:\wabtec\files\BSLSRV0001_Customer_Files\Customer Files\1. Customer Information\Siemens Mobility\2021\Purchase Orders\PO 4509763478, SO-0014037, 49364-14, 2021-12-14\Buy America Certificate_Rev.1 (PO 4509763478) - Signed Dec. 22, 2021.pdf F:\wabtec\files\WBJSRV0002_Accounting\Accounting\ABNER\ateixeira\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SH5IQIL6\597D3FCACB12FBFAC9CEBBAFF93D[1].jpg

  17. Message 017 From Victim Victim Date

    14 total please.

  18. Message 018 From LockBit 3.0 Actor / other Date

    https://temp.sh/mSrti/files.7z

  19. Message 019 From LockBit 3.0 Actor / other Date

    password = 5446731864718376751313472162

  20. Message 020 From Victim Victim Date

    Thank you for this. Sending to the bosses for review, be back in touch.

  21. Message 021 From Victim Victim Date

    Hello, can you please decrypt these files so we know your key works per your message on this site?

  22. Message 022 From Victim Victim Date

    File: [registry.xml.lockbit]

  23. Message 023 From LockBit 3.0 Actor / other Date

    File: [registry.7z]

  24. Message 024 From Victim Victim Date

    Thank you. So if we were considering payment, would we get 1. Working decryptor tool 2. Our data back or deleted 3. Guarantee to not publish it or leak it on dark web 4. Tell us how you got into our network? Please let us know.

  25. Message 025 From LockBit 3.0 Actor / other Date

    1 yes 2 yes 3 yes 4 no

  26. Message 026 From Victim Victim Date

    Ok, letting bosses know the above. We are still reviewing the data dump due to size, and will be talking to the bank to see how much funds we would be avle to come up with. Be back in touch.

  27. Message 027 From Victim Victim Date

    Hello, is this all of the data you have taken from us, in your file listing? Can you please let us know. Thank you.

  28. Message 028 From LockBit 3.0 Actor / other Date

    Yes

  29. Message 029 From Victim Victim Date

    Ok, that is good for us to know. We will be trying to come up with as many funds as we can and are circling up with the bank when they open after the weekend. How do we get BTC? Thanks.

  30. Message 030 From LockBit 3.0 Actor / other Date

    You can use crypto exchanges to get btc.

  31. Message 031 From LockBit 3.0 Actor / other Date

    So? Weekend ended long time ago. Are you ready to pay?

  32. Message 032 From Victim Victim Date

    Hello we are engaged with the bank, the logistics are going to take a little bit of time. This is not something we are used to deal with. We need some more time please.

  33. Message 033 From LockBit 3.0 Actor / other Date

    You must hurry up. We're not going to wait you forever. We'll have to raise the price by friday if we won't receive full payment by tomorrow evening.

  34. Message 034 From Victim Victim Date

    Hello our bosses and executive team are in contact with the bank about logistics and how much we can get, this is not something they normally do so the logistics are hard and take some time. We cannot make this happen by Friday, we are asking for more time, next week please. We are talking to you in good faith and thank you for your help so far.

  35. Message 035 From LockBit 3.0 Actor / other Date

    You already have spent 3 weeks. It's more than enough to check your balance and obtain cryptocurrency. The price will be raised to 30M from tomorrow.

  36. Message 036 From LockBit 3.0 Actor / other Date

    Hello. Another week passed. Should we wait for payment or we may proceed to the publication of your files?

  37. Message 037 From LockBit 3.0 Actor / other Date

    Are you there?

  38. Message 038 From LockBit 3.0 Actor / other Date

    ???

  39. Message 039 From LockBit 3.0 Actor / other Date

    wtf?