Checkout Ltd refuses to pay, donates ransom to research instead

Turning a breach into positive PR

Checkout Ltd’s CTO: “We will not pay this ransom”

The glut of modern cybercrime can, at least in part, be attributed to companies who have done the maths and worked out that it’s cheaper to pay criminals off than lose weeks of operations. Sad but true.

So it’s refreshing to see London-based payment processing provider Checkout Ltd, commonly known as Checkout.com, take a more principled approach – not only refusing to pay up, but taking full responsibility for a recent breach.

ShinyHunters, which has successfully attacked Red Hat and Pandora among others in the last year, contacted Checkout Ltd last week claiming to possess stolen data and demanding a ransom.

The group “gained access to a legacy, third-party cloud file storage system,” according to a blog post by CTO Mariano Albera.

Checkout had used the system for internal operational documents and merchant onboarding materials up until 2020, but it appears that the company failed to decommission it properly.

“This was our mistake, and we take full responsibility,” said Albera.

An internal investigation estimated that the attack affected “less than 25%” of Checkout’s current merchant base, but didn’t impact the payment processing platform itself. The threat actors were also unable to access merchant funds or card numbers.

Albera added, “We are sorry. We regret that this incident has caused worry for our partners and people. We have begun the process to identify and contact those impacted and are working closely with law enforcement and the relevant regulators. We are fully committed to maintaining your trust.

“We will not be extorted by criminals. We will not pay this ransom.”

In a refreshing move, Checkout isn’t just refusing to pay and keeping hold of the ransom amount: it’s donating it to Carnegie Mellon University and the University of Oxford Cyber Security Centre “to support their research in the fight against cybercrime.”

It’s certainly refreshing to see a company not only take responsibility for a breach, but go out of its way to turn that into a positive for the industry.