Dish Network most likely paid ransom to BlackBasta after the ransomware attack

American satellite broadcast provider Dish Network, which suffered a ransomware attack in February, has confirmed that the recent cyber incident has impacted more than 296,000 individuals. Dish informed the Maine Attorney General’s Office that the data breach exposed information, including name and other personal identifiers combined with driver’s license or non-driver identification card numbers.

According to reports, Dish Network most likely paid a ransom, based on the wording used in data breach notification letters sent to impacted individuals. While it didn’t directly confirm it paid, Dish implied as much by saying it "received confirmation that the extracted data has been deleted."

Ransomware gangs only delete data or provide a decryption key after paying a ransom. Therefore, reports suggest that it is highly unlikely that Dish could receive confirmation that the stolen data was deleted without paying. Sources said that the Russia-linked BlackBasta ransomware group was behind the attack.

Notably, paying a ransom does not ensure that data that has been stolen has been completely erased. Previous incidents have shown that those who paid the ransom were later subjected to additional extortion, had their data sold to other threat actors, or had it leaked on data leak websites.

In the notification letters, the company also stated that no customer information was compromised during the ransomware attack. However, Dish discovered that the breach had exposed confidential records and sensitive information belonging to current and former employees (and their families).

The security incident occurred in late February when various Dish services became inaccessible, including its websites and applications. Later, the company confirmed that the outage was caused by a ransomware attack and acknowledged that personal information may have been stolen.