THE FIRST OFFER EFFECT IN RANSOMWARE NEGOTIATIONS

Abstract: This study examines the first offer effect in authentic ransomware negotiations, a rapidly expanding and understudied form of cyber-extortion. Analyzing a dataset of 238 transcripts, we assess how numerical precision, justification, repetition, and framing of the initial demand influence final settlements. In this study, we present a preliminary analysis of 40 confirmed paid cases. Our initial observations highlight a contrast between how attackers typically behave and which strategies appear to yield the best results. While attackers predominantly utilize rounded and gain-framed demands, deviation analysis suggests that precise offers may anchor settlements more effectively, resulting in final payments significantly closer to the initial demand compared to rounded ones. Similarly, gain-framed demands appeared to show stronger alignment with the first offer than loss-framed ones. These patterns provide rare empirical evidence of first offer dynamics in high-stakes cyber-extortion, offering new insights for theory and practice.

Keywords: first offer effect, ransomware, negotiation, archival data analysis