‘Why should we pay these criminals?’: the hidden world of ransomware negotiations

Anna Isaac reports on the hidden world of ransomware negotiations, describing what they call “stopping the bleeding,” the vital window to prevent a database in a hacked business or production line from being ransacked. When a call comes into the London-based cybersecurity firm S-RM, firms “may have just minutes” to act.

S-RM, headquartered on Whitechapel High Street, has helped a high-profile retail client recover from a Scattered Spider cyber-attack, and now claims to be the UK’s largest cyber-incident response team. The firm’s senior staff are multilingual and maintain a minimal online footprint, with CVs that suggest corporate or government intelligence-based careers. According to The Guardian, the article notes these details and provides broader context around ransomware negotiations.

Published on 30 December 2025, the piece highlights how S-RM’s approach and reputation have become increasingly prominent in the incident-response landscape.