A notorious ransomware group has received the largest ransom payment ever

A laptop with a red screen with a white skull on it with the message: "RANSOMWARE. All your files are encrypted."
(Image credit: Getty Images)

An unnamed Fortune 50 company has reportedly paid the Dark Angels ransomware gang an eye-watering $75 million to reclaim control of its systems.

The report by Zscaler ThreatLabz noted the payment marks the highest known ransom ever paid, considerably surpassing the previous record of $40 million held by insurance giant CNA after a ransomware attack by Evil Corp.

The emerging widespread threat of ransomware attacks combined with a new record-breaking payment has sparked serious concern among cybersecurity specialists, who only see the threat as getting worse.

$75 million ransom payment breaks all records

While Zscaler did not disclose the identity of the Fortune 50 company, they mentioned the incident occurred in early 2024. Speculation points to pharmaceutical giant Cencora, ranked number 10 in the Fortune 50 list, which experienced an attack in February 2024. No ransomware gang is known to have claimed responsibility for the attack, suggesting a ransom payment might have been made.

The report also illustrates the increasing threat from ransomware gangs – the company identified 19 new ransomware families, blocked 17.8% more attacks than the year before, and saw 57.8% more extorted companies on data leak sites.

Zscaler revealed the US accounts for virtually half (49.95%) of all attacks, with countries like the UK, Germany, Canada and France also at a higher-than-average risk, with critical infrastructure and sectors like manufacturing, healthcare and technology seeing the most attacks.

The ransomware group responsible for the record-breaking $75 million payment, has been operating since around May 2022. In September 2023, the gang, known as Dark Angels, unsuccessfully demanded a $51 million ransom.

TechRadar Pro has asked Cencora to confirm whether it paid a ransom for its February 2024 attack, but we did not receive an immediate response.

More from TechRadar Pro

Craig Hale

With several years’ experience freelancing in tech and automotive circles, Craig’s specific interests lie in technology that is designed to better our lives, including AI and ML, productivity aids, and smart fitness. He is also passionate about cars and the decarbonisation of personal transportation. As an avid bargain-hunter, you can be sure that any deal Craig finds is top value!

Read more
A laptop with a red screen with a white skull on it with the message: "RANSOMWARE. All your files are encrypted."
Less than half of ransomware incidents end in payment - but you should still be on your guard
A laptop with a red screen with a white skull on it with the message: "RANSOMWARE. All your files are encrypted."
More reports claim 2024 was the worst year for ransomware attacks yet
ransomware avast
Ransomware attacks are costing Government offices a month of downtime on average
A group of 7 hackers, 6 slightly blurred in the background and one in the foreground, all wearing black with hoods pulled up over their heads. You cannot see their faces. The hacker in the foreground sits with an open laptop in front of them. The background, behind the hackers, is a Chinese flag
China government-linked hackers caught running a seriously dangerous ransomware scam
A laptop with a red screen with a white skull on it with the message: "RANSOMWARE. All your files are encrypted."
Bad news - businesses who pay ransomware attackers aren’t very likely to get their data back
sewage water treatment
Southern Water denies claims it offered $750,000 ransom to ransomware hackers
Latest in Security
Data leak
Top home hardware firm data leak could see millions of customers affected
Representational image depecting cybersecurity protection
Third-party security issues could be the biggest threat facing your business
A stylized depiction of a padlocked WiFi symbol sitting in the centre of an interlocking vault.
Broadcom warns of worrying security flaws affecting VMware tools
Android Logo
Devious new Android malware uses a Microsoft tool to avoid being spotted
URL phishing
HaveIBeenPwned owner suffers phishing attack that stole his Mailchimp mailing list
Ransomware
Cl0p resurgence drives ransomware attacks to new highs in 2025
Latest in News
An image of Pro-Ject's Flatten it closed and opened
Pro-Ject’s new vinyl flattener will fix any warped LPs you inadvertently buy on Record Store Day
EA Sports F1 25 promotional image featuring drivers Oscar Piastri, Carlos Sainz and Oliver Bearman.
F1 25 has been officially announced, with this year's entry marking a return for Braking Point and a 'significant overhaul' for My Team mode
Garmin clippd integration
Garmin's golf watches just got a big software integration upgrade to help you improve your game
Robert Downey Jr reveals himself as Doctor Doom to a delighted crowd at San Diego Comic-Con 2024
Marvel is currently revealing the full cast for Avengers: Doomsday, and I think it's going to be a long-winded announcement
Samsung QN90F on yellow background
Samsung announces US prices for its 2025 mini-LED TV lineup, and it’s good and bad news
Nintendo Switch Lite
Forget the Nintendo Switch 2, the original Switch is getting one last hurrah in a surprise Nintendo Direct tomorrow