If potential bidders know that data will be posted for free if it fails to sell at auction, it could possibly decrease the effectiveness of auctioning off the stolen data. The public posting of the data means that the one benefit to purchasing the data at auction is exclusive ownership of the data. This could lead to only the “juiciest” or most criminally valuable data seeing any activity on the auctions page, especially with the current pricing model being used by REvil. When the data gets posted publicly, it opens the victims up to a wide range of attacks and targeting from any number of criminals who choose to access the now publicly available information. This continued evolution of how ransomware operators act makes the protection, detection, and response to ransomware attacks gravely important for organizations of all industries and sizes. The best approach to defense against ransomware attacks is twofold: 3-2-1 data backups and Endpoint Detection and Response (EDR). Back up often, keep three copies of backups, on two different media types, with at least one backup maintained off-site. EDR is the best means of getting ahead of an attack by allowing for early detection–meaning early protection by being able to quarantine infected systems and minimizing the impact and spread of ransomware while minimizing the amount of data which can be stolen by attackers.