Some good news: downstream victims of mass data theft campaigns are less likely to pay — incident responders

Coveware’s Q4 2025 analysis, referenced by BankInfoSecurity and DataBreaches, reports that “zero-day downstream mass data extortion campaigns” like those pioneered by the CL0P group (e.g., 2023 MOVEit) are losing financial leverage as more victims—also seen in Snowflake-related 2024 and CRM-focused 2025 breaches linked to ShinyHunters—decline to pay. The piece describes escalating harassment tactics (e.g., SWATTING, direct calls to executives) when victims disengage, and contrasts guidance on whether to respond at all to ransom notes, urging organizations to carefully weigh known scope, attacker reputation, backups, and to consult law enforcement and experienced IR before engaging.