In June 2021, the world's largest beef producer paid $11 million to criminals while its plants were running and its own backups were already rebuilding most of what the ransomware had locked.
JBS was hit by REvil ransomware on May 30, 2021. Some of its North American and Australian IT systems were encrypted and several food production sites paused. Then a strange thing happened. In its June 9 statement, the company confirmed paying "the equivalent of $11 million in ransom", and gave its reasons in one clause: to "mitigate any unforeseen issues related to the attack and ensure no data was exfiltrated." Not because production was down: at the time of payment, the company said, the vast majority of its facilities were operational, and it credited its quick recovery to its "redundant systems and encrypted backup servers."
Plants running, backups carrying most of the load, money out the door anyway.
I have thought about that sentence for years, because it quietly retires the picture most of us keep of ransomware. In that picture, a gang encrypts your files and you pay because the backup you never tested turned out to be imaginary. That still happens every day, to companies far smaller than JBS. But the crews changed their product. These days, long before anything gets encrypted, someone spends weeks inside the network quietly copying the sensitive stuff out, and when the demand arrives it carries two prices. The expensive one is not the lock. It is the leak. A negotiation chat that later surfaced shows the REvil opener with JBS was a warning that data would be leaked if the ransom was not paid. It also shows the backup story had a hole in it: JBS told the criminals it needed their decryptor for two specific databases, because the rest of the data was being restored from backups. CISA's ransomware guide names the shift in its own Part 1 title: "Ransomware and Data Extortion Prevention Best Practices."
What the backup actually buys
None of this makes the backup advice wrong. CISA's ransomware checklist puts it first: maintain offline, encrypted backups of data and regularly test your backups. And the guidance explains why the word "offline" is doing the work - many ransomware variants "attempt to find and subsequently delete or encrypt accessible backups to make restoration impossible unless the ransom is paid." A backup that survives is a real control.
But be honest about what it controls. It shrinks the ransom conversation from "everything you own" down to "the copy of your data we already hold." It decides what you are negotiating about. It does not decide whether you are negotiating.
Three companies, one spring
Colonial Pipeline paid $4.4 million, roughly 75 bitcoin, after DarkSide hit it that same May. Its CEO, Joseph Blount, later told the Wall Street Journal he authorized the payment because executives were unsure how badly systems had been breached and how long the pipeline would take to come back. A month later the Justice Department had seized back about $2.3 million of it. Whatever else that payment was, it was certainty bought on a clock the company could not read.
The Irish health service refused to pay anything. Conti had been inside its network since March 18 and detonated on May 14 with a demand of almost $20 million, and Ireland's Comptroller and Auditor General recorded that the health service "did not engage with the attackers and did not pay any ransom." Conti released a decryption tool a week later anyway. Getting everything back still took time: all servers were only considered decrypted on September 21 - 130 days after the encryption - with 99 percent of applications restored, and the auditor counted 51 million euro of recovery and rebuilding spending in 2021 alone. The keys came free. The bill did not.
JBS is the case I keep returning to, because it came closest to winning the race the old advice promises you can win. Backups carrying most of the load, operations restored, a company that spends more than $200 million a year on IT and employs more than 850 IT professionals globally. This was not a shop caught without a plan. And its own preliminary investigation found that no company, customer or employee data was compromised - which makes the $11 million stranger still: insurance against an outcome the company believed had not happened, priced by an adversary on the worst possible day to be buying.
I am not saying JBS was wrong to pay. Eleven million against a leak threat and two databases nothing else could unlock is a judgment call, and I was not in the room. The narrower point stands anyway, and it is the part small site owners get wrong: the moment extortion crews added data theft, "we have backups" stopped being a defense and became a negotiating position.
The blast radius is the real boundary
I run a small leaderboard, not a meatpacking empire, and the same arithmetic prices my decisions there. The board is built so almost nothing on it is irreplaceable: a listing can be delisted, a rank re-derived from the paid bids that define it. The database is the one thing that is not. It is customer emails and money rows, and a copy of it in the wrong hands would cost us nothing in downtime and everything in trust. So the Postgres database is dumped nightly, encrypted, and shipped off-site to object storage, with seven daily and four weekly copies kept, and the repository password lives in exactly two root-only locations - one on the server, one offline on the owner's machine. The ugly path gets rehearsed too: a monthly script restores the newest snapshot into a throwaway database and diffs the tables against production. The first time that script ever ran, it caught the nightly backup silently dead for two nights. A backup is a theory until you have restored it and counted the rows.
And I hold no illusions about what that drill proves. It proves the site can be back by Friday. It says nothing about the copy that walked out on Tuesday, and the copy is what a ransom is now actually priced against. So the work that matters most is shrinking the radius around the data itself: collect less, hold access shorter, and know what a copy of your data is worth in the wrong hands before somebody else sets the price.
Audit your data like your ransom depends on it - then bid your way to the top spot at bidspotlight.com/submit.