Did you hear the one about the ransom victim who made a ransom installment payment after they were told that it wouldn’t be accepted?

Millicom faced a ransomware dispute after ShinyHunters claimed to have exfiltrated 380 million customer records, including names, email addresses, account numbers, and masked card details, with a date of mid‑September attack and a demand of 15 BTC.

Negotiations began on 4 November, and DataBreaches[.]Net notes that Millicom initially sought a single payment but then made a high‑risk move by sending a first instalment, asking ShinyHunters to accept $10,000 a month for at least five years as long as data was not leaked. The threat actors insisted they would not accept a payment plan, demanding the full amount in one transaction, and on 13 November the data were listed for sale.

DataBreaches[.]Net states that Millicom ultimately sent a monthly instalment, with a next payment of $10,000 scheduled for 10 December, prompting ShinyHunters to respond that they would leak the data if the full sum was not paid immediately. This account, according to DataBreaches[.]Net, is supported by chat logs provided by ShinyHunters and comments from Valery Rieß‑Marchive of LeMagIT.