When the FBI offers a decryptor: what ALPHV’s takedown asked of public agencies

The week

On December 19, 2023, the Justice Department announced a disruption campaign against the ALPHV ransomware group, also known as BlackCat, which it described as one of the most prolific ransomware-as-a-service operations in the world.

For hundreds of organizations, the experience ran roughly like this. A county government’s systems have been locked for three days. Files on the servers have been scrambled into gibberish, and a note on every screen demands payment in cryptocurrency for the key to unscramble them. Then the phone rings. The caller says they are with the FBI, and they have a tool that might get the data back for free.

Ransomware is malicious software that encrypts an organization’s files, meaning it scrambles them with a secret key so they cannot be read, and the criminals then demand a ransom for the key. Most gangs now also steal copies of the data first and threaten to publish it. “Ransomware-as-a-service” means the core group runs the business like a franchise: it builds the software, the payment systems and the public “leak site” where stolen data is posted, and it recruits independent hackers, called affiliates, who break into victims and share the ransom.

The FBI had gained access to the group’s network, developed a decryption tool, which is software that reverses the encryption, and offered it to more than 500 victims. The department said this spared victims ransom demands totaling about $68 million. Agents also seized the group’s leak site.

The criminals hit back. Within hours ALPHV posted a notice claiming to have taken the site back and said it would drop its stated restrictions on affiliates, including on attacking hospitals and other critical infrastructure. In effect, it told its franchisees that anything was now fair game.

The same week brought a regulatory milestone. On December 18, the SEC’s requirement for public companies to disclose material cybersecurity incidents on Form 8-K took effect. Form 8-K is the filing public companies use to tell investors about significant events between their regular reports. The two events together captured the moment: law enforcement was getting better at helping victims, and the legal duties on victims were getting sharper at the same time.

Removing one ransomware brand leaves the affiliates, the techniques and the victim’s own weaknesses in place. The ALPHV operation showed as much within hours, when the group announced it was back and loosening its rules.

It also raised a narrower, more practical question, one the FBI’s takedown of Hive in January 2023 had raised too. In each operation, the FBI had covert access for months and provided decryption help to victims, some of whom heard about it first from an agent. State and local agencies, school districts and public health departments are frequent ransomware targets, and few incident response plans say what to do when that help arrives. Accepting it well involves three distinct tasks, in the order they arise: confirming the offer, using the tool, and keeping legal duties on their own clock. First, though, what a ransomware attack actually does inside an organization, because the rest of the argument depends on it.

What happens inside a ransomware attack

A ransomware attack is not a single event. It is closer to a burglary in which the intruders live in the house for a while before anyone notices. Typically, an affiliate gets in through a weak point: a stolen password, an unpatched internet-facing server, a remote-access tool left open, or an employee tricked by a convincing email. Once inside, the intruder looks around, gains higher levels of access, and often creates new accounts or installs remote-control software so they can come back. They copy sensitive data out. Only then, often at night or over a weekend, do they trigger the encryption that makes the attack visible.

By the time the ransom note appears, three separate problems exist. The data is locked. The attacker may still have a foothold in the network. And copies of sensitive data may already be in criminal hands. A decryption tool addresses only the first. That single fact shapes almost everything that follows.

For a public agency, the stakes are concrete. A locked county system can mean no property tax payments, no building permits, no court scheduling, and dispatchers working from paper. A school district may lose access to student records and payroll. A public health department may lose immunization records. The cost runs well beyond IT: overtime, outside consultants, delayed services, angry residents and difficult questions from elected officials.

Confirming the offer

An unexpected contact from someone claiming to be a federal agent, in the middle of an incident, is exactly the kind of approach criminals imitate. A stressed organization desperate for its data is an ideal target for a second scam, such as a fake “recovery service” or a request to install software that turns out to be malicious.

Agencies should verify any such contact through a channel they already trust: the FBI field office’s published number, the agency’s existing contact there, or the state fusion center. A fusion center is a state or regional hub where federal, state and local agencies share threat information. The rule is to hang up and call back on a number already known to be genuine, never the one the caller provides.

That is far easier when the relationship exists before the incident. An agency that has met its field office’s cyber squad, knows the name of a special agent, and has recorded those details in its offline incident binder can confirm an offer in minutes. “Offline” matters: if the agency’s email and file servers are encrypted, a contact list stored on them is useless. A printed binder, or a copy kept on a separate device, is not.

The plan should also name who is authorized to speak with law enforcement for the agency, and what they may share. Investigators will ask for logs, which are the records systems keep of who did what and when, as well as malware samples and indicators, the technical fingerprints of the attack. Counsel should agree in advance what can be shared without delay. That matters most where systems hold criminal justice information under CJIS policy, federal tax information or health data, each with its own handling rules. CJIS is the FBI’s Criminal Justice Information Services security policy, which governs how police and court data may be handled; federal tax and health data carry their own restrictions. Sorting out those questions at two in the morning, mid-incident, is how delays happen.

One coordinator, not five

Local agencies rarely respond alone. A county may be supported by the state chief information security officer’s team, a state National Guard cyber unit, a regional information sharing center and its insurer’s incident response firm at the same time. Each may receive information from the FBI. The incident plan should name one coordinator who receives offers of help, logs them, and decides who acts on each, so that a decryptor is not run twice by different teams or not at all.

Take a county on day two of an attack. The insurer’s responders are imaging servers, the state team is reviewing firewall records, and a Guard unit is checking the sheriff’s systems. An FBI agent emails the county IT director, who is asleep after thirty hours awake, while a deputy speaks to a different agent by phone. Without a named coordinator, two teams may each believe the other is handling the decryptor. With one, the offer is logged, verified and assigned within the hour.

Using the tool

A decryptor developed by law enforcement is a recovery tool of unknown quality in the agency’s specific environment. It may work perfectly, partially, or slowly. Running it carelessly can damage the files it is meant to recover.

The safe procedure is the same one incident responders apply to any decryptor. First, preserve forensic images of affected systems: exact, sector-by-sector copies of the disks, kept untouched as evidence and as a fallback. Second, test the tool on copies, not originals. Third, check the integrity of decrypted data against backups or application checks, for example by confirming that a database opens and its records add up. Only then run it at scale. That work usually needs outside incident response help, which is why a retainer arranged in advance matters. A retainer is a pre-agreed contract with an incident response firm, so that experts can start work within hours rather than after a procurement process.

Decryption also answers only one question. It restores data. It does not remove the attacker’s accounts, scheduled tasks or remote access tools, and it does not close the hole they came through. Systems decrypted in place may still be compromised. Bringing them straight back online leaves the attacker’s way in open.

Most agencies should treat a decryptor as a way to recover data that their backups lack, starting with the systems whose data cannot be reconstructed any other way, such as records created since the last good backup, and rebuild the systems themselves from known-good images. A known-good image is a clean, trusted copy of a server’s software that can be reinstalled from scratch. A recovery plan that assumes no decryptor will ever arrive, built on offline tested backups and documented rebuild procedures, is also the plan that uses one best when it does.

Keeping legal duties on their own clock

Law enforcement involvement can change some timelines and leave others untouched. Some notification regimes allow delay at law enforcement’s request, and the SEC rule for public companies included a narrow mechanism for national security or public safety delays. Most state breach notification laws turn on the theft or acquisition of personal information. Decryption does nothing about data the attackers already took, and ALPHV, like most groups, stole data before encrypting it.

This is where well-meaning leaders most often go wrong. The relief of getting data back can feel like the end of the incident. If residents’ names, Social Security numbers or medical details left the network, the agency may owe them notice regardless of whether a single file is ever decrypted.

An agency should therefore run its breach assessment in parallel with recovery, from the first day. Its counsel should confirm which notification duties apply under state law and sector rules, whether any law enforcement delay request is in writing and what it covers, and how cooperation affects public statements. A verbal “please hold off” from an agent is not something an agency can safely rely on months later when a regulator or plaintiff asks why notice was late.

Cyber insurers, where the agency has coverage, usually require prompt notice and approval of vendors, and a free decryptor does not suspend those terms. An agency that brings in a firm the insurer has not approved, or delays telling the insurer because the FBI seemed to have things in hand, can find its claim disputed. Communications staff need a line that acknowledges cooperation with law enforcement without describing an investigation the agency does not control.

Two counties, one phone call

To see how the three tasks fit together, suppose two counties are hit by the same ransomware affiliate in the same week, and each is later contacted by the FBI with a decryptor.

The first county wrote its one-page plan the year before. Its IT director recognizes the agent’s name from a meeting at the field office and confirms the call through the office’s published number within twenty minutes. The coordinator logs the offer and assigns it to the insurer’s incident response firm, which is already on site under a retainer. The firm images the affected file servers, tests the decryptor on copies, and finds it works on most files but corrupts a handful of large database files. Those are restored from last week’s offline backup instead, and the decryptor is used only for documents created since then. Every server is rebuilt from clean images before going back online. Meanwhile, counsel has been running the breach assessment since day one and has already identified which residents’ records were in the stolen folders. The agency asks for the FBI’s delay request in writing, gets it, and notifies residents on a defensible timeline.

The second county has no plan. Its staff spend a day trying to work out whether the caller is genuine. Two outside teams each assume the other is handling the tool. When someone finally runs it, they run it directly on the production database, and the files that do not decrypt cleanly are now damaged with no clean copy to fall back on. Decrypted servers go straight back into service, still carrying the attacker’s remote access software. Because the data is back, the breach assessment is put off, and the county discovers months later that residents should have been notified.

Both counties received the same free help. The difference in outcome came entirely from preparation that cost little and was done long before the attack.

A test of governance

For an elected official, a city manager or an agency head, a ransomware incident is a test of governance as much as technology. The questions that follow are about money (what did recovery cost, and did insurance pay), service (how long were residents without core services), law (were notices sent on time), and trust (did the agency explain itself clearly and honestly).

A law enforcement decryptor can improve all four, but only for an organization ready to use it. The agency that cannot verify the call loses days. The agency that runs the tool on originals may lose data. The agency that treats decryption as the end of the incident may miss notification deadlines and leave attackers inside. The free help is real, and so is the risk of squandering it.

There is also a broader point. The ALPHV episode showed that takedowns do not end ransomware; the group announced its return and loosened its rules within hours. Preparation for law enforcement help sits on top of basic defenses such as multi-factor authentication, which requires a second proof of identity beyond a password, prompt patching and tested backups; it cannot replace them.

The page worth writing

These three tasks fit on a single page of an incident plan, and that page is worth writing. A good page lists, at minimum:

• Named contacts at the FBI field office, the state security team and the fusion center, with phone numbers, kept offline.
• The person authorized to speak with law enforcement, and a short list, agreed with counsel, of what can be shared immediately and what needs review.
• The single coordinator for offers of outside help, with a deputy.
• The incident response retainer details and the procedure for testing any decryptor: image first, test on copies, verify, then scale.
• A breach assessment that starts on day one, a checklist of notification duties, and the rule that any law enforcement delay request must be in writing.
• The insurer’s notice requirements and approved vendor list.

The usual failures are trusting an unverified caller because the news is welcome, running a decryptor directly on production systems, bringing decrypted servers back online without rebuilding them, pausing the breach assessment because recovery seems to be going well, and letting several outside teams act on the same information without a coordinator. Each is understandable under pressure. Each is avoidable with a page written in calmer times.

What to settle before the phone rings

1. Do we know, by name, someone at our FBI field office’s cyber squad, and is that contact written down somewhere that would survive our systems being locked?
2. Who is allowed to talk to law enforcement for us during an incident, and what have our lawyers agreed they can share straight away?
3. If the state, the National Guard, our insurer and the FBI all offered help on the same day, who would coordinate them?
4. If someone handed us a decryptor tomorrow, what is our procedure for testing it before using it, and which incident response firm would do the work?
5. Does our plan start the breach and notification assessment on day one, separately from recovery?

The supporting details matter as much: the handling rules for any criminal justice, federal tax or health data, how quickly a retained firm can start, when a critical system was last restored from offline backups, and what the cyber insurance policy requires in the first 24 hours. A takedown is the best case for a victim. Agencies that have the contacts, the technical procedure and the legal checklist ready get the full benefit of it.

With hindsight

ALPHV’s return was brief and damaging. Its affiliates attacked Change Healthcare in February 2024, causing one of the most disruptive cyber incidents in U.S. healthcare history.

In early March the group appeared to vanish in what researchers widely described as an exit scam, after an affiliate complained of not being paid its share of a large ransom. An exit scam is what it sounds like: the operators shut down and disappear with the money, leaving their partners unpaid. Its affiliates moved to other operations. That pattern bears out the argument above: the people and techniques behind ransomware outlast any single brand.

In February 2024 an international operation led by the UK’s National Crime Agency and the FBI also disrupted LockBit and obtained more than 1,000 decryption keys to help victims, again through law enforcement channels. Ransomware against state and local government continued through 2025. For counties, cities and school districts, the threat did not fade when the brand names changed; the same kinds of intruders simply worked under new banners.

Takedowns and decryption offers became a recurring event rather than a one-off, which made the single page described above more useful. That has two practical consequences. The call from law enforcement is now a realistic scenario rather than a remote one, and an agency that has rehearsed it will move faster and make fewer mistakes when it comes. And these operations did nothing to reduce the need for an agency’s own resilience. Each takedown helped victims of one group at one moment, while the affiliates moved on.

The organizations that benefited most from these operations were those that already had offline backups, named contacts and a legal checklist. For a county board or a school district, that single page in the incident plan is one of the cheapest pieces of preparation available, and one that pays off whether help arrives or not.