Why Ransom Notes Read Like Demand Letters

The corporate counsel who first reads a current ransom-extortion communication will often note that the document feels familiar. The tone is restrained. The structure is recognisable. There is a statement of fact, a demand for engagement, a deadline, and a list of consequences. The vocabulary borrows from pre-litigation correspondence: phrases like in your best interests, failed to reach an agreement, despite our incredible patience. The form is not improvised. It is the form of a demand letter.

This piece extends the analysis in Reading the Ransom Note: The 2026 Extortion Economy in the Actors’ Own Words. That earlier piece read four ransom notes for what their content tells us about the modern extortion product. This one reads them for what their form tells us — about how the actor positions itself relative to the institutions the victim would normally engage, and about how well or poorly the drafter has internalised the persuasive-writing canon they are imitating. The form is a legitimation tool, the choice of form is doing rhetorical work, and reading that work against the standard coursework on persuasive writing surfaces a useful pattern: the actor follows persuasion theory at the macro level, and breaks it at the level of register.

Three forms are visible across the current ShinyHunters leak site. Each is borrowed from a recognisable register of professional communication.

The demand-letter scaffold

The standard live-warning tile on the leak site uses templated language repeated across multiple concurrent and prior victims. The Houghton Mifflin Harcourt tile, dated 9 May 2026, reads:

Your data was compromised in several of our campaigns throughout the past few months. We urge you to engage with us, it is in your best interests. This is a final warning to reach out by 12 May 2026 before we leak along with several annoying (digital) problems that’ll come your way. Make the right decision, don’t be the next headline.

Map this against the components of a routine demand letter as taught in business law and legal English coursework:

• Statement of facts: “Your data was compromised in several of our campaigns throughout the past few months.”
• Demand for action: “We urge you to engage with us, it is in your best interests.”
• Deadline: “by 12 May 2026.”
• Consequences of non-compliance: “before we leak along with several annoying (digital) problems that’ll come your way.”
• Final emphasis: “Make the right decision, don’t be the next headline.”

The match is close enough to be deliberate. The phrase in your best interests is a fossil from legal correspondence: it functions to recast the recipient’s compliance as their own rational choice rather than coercion. The Dutch civil-law equivalent, an ingebrekestelling (formal notice of default under articles 6:81–6:83 of the Burgerlijk Wetboek), follows an almost identical structural pattern. So does the standard form taught in any business-communication course as the template for a serious demand letter.

For corporate counsel, this matters because counsel processes a demand-letter-format document through familiar rails. The reading protocol is internalised: identify the asserting party, identify the asserted facts, calibrate the demand against likely good-faith scope, evaluate consequences, plan a response. A document that arrives in this format recruits all of that processing infrastructure. The actor is, in effect, putting the extortion communication through counsel’s normal channels of evaluation rather than triggering crisis-response channels.

The pleading register: “they don’t care”

After a deadline has passed without payment, the live-warning tile transitions to a download tile with a different boilerplate. Almost every completed extortion on the leak site uses some variant of this language. A representative example, from one of the larger Salesforce-campaign tiles:

The company failed to reach an agreement with us despite our incredible patience, all the chances and offers we made. They don’t care.

This is the structure of a litigation pleading or a termination-for-cause letter. Map it against the standard rhetorical structure of a justification narrative:

• Establish the actor’s reasonable conduct: “despite our incredible patience”
• Enumerate offered remedies: “all the chances and offers we made”
• State the counterparty’s failure: “failed to reach an agreement”
• Attribute fault: “They don’t care.”

Litigators recognise this immediately. It is the rhetorical move that opens a complaint pleading, the boilerplate of a statement of claim, the closing sentence of a termination letter justifying the basis for a for-cause dismissal. The actor is positioning itself as the reasonable counterparty who exhausted good-faith options, and positioning the victim as the unreasonable counterparty whose obstinacy compelled the consequences.

This positioning is meant for an audience. The download tile is a public-facing document. The visible audience for the boilerplate is not the victim — the victim already knows the negotiation history — but the journalists, regulators, customers, and counterparties who will read the tile after the leak. The leak site is, structurally, a court of public opinion, and the actor is filing its pleading. The strategic problem with this pleading, as we will see below, is that the drafter has chosen to state the theory of the case rather than allow the facts to imply it — an early-coursework error.

The corporate-comms holding statement

A separate panel on the leak site, dated 9 May 2026, reads:

Due to the significant amount of press inquries [sic] we are receiving every hour from all around the world, we are making a public statement. We are not commenting and have no further comment to make regarding this global incident.

This is the closest to direct mimicry of a specific legitimate document type. Public-relations training teaches a precise three-beat structure for the holding statement — the formal communication an organisation issues when it must respond to press inquiries before a substantive position is ready:

1. Acknowledge the volume of inquiries (signals legitimacy and scale).
2. State the reason for going public (justifies the response itself).
3. Decline substantive comment (the actual content).

The leak-site panel hits all three beats verbatim. It is not a paraphrase or a parody. It is the holding-statement template, executed at coursework standard. PR professionals reading the panel will note that it is the same form they would draft for their own client in the early hours of a crisis.

The implications are operational. Some journalists working a global story on a tight deadline will reach out to the actor before they reach the victim, because the actor publishes a contact channel and the victim is in a closed war-room with external counsel. The actor’s holding statement, written to the same form as a legitimate organisational response, will be quoted alongside the victim’s eventual statement by the same outlets. A press-handling layer that does not anticipate the actor as a parallel comms endpoint is operating on a 2018 model of breach response.

Why register choice matters

The borrowed forms are not aesthetic. They are a legitimation tool. Each register the actor adopts is the register of an institution the victim would normally engage to defend itself. The demand-letter format borrows the register of corporate counsel. The justification-pleading format borrows the register of litigation. The holding-statement format borrows the register of corporate communications. The actor is, across every public-facing document on its leak site, speaking the language of the systems the victim would otherwise use to mount a response.

The effect is a collapse of cognitive distance. A document that looks like routine pre-litigation correspondence, sounds like a litigation pleading, or follows the template of a holding statement is processed through the recipient’s existing professional rails. The recipient applies the protocols built for legitimate documents. The actor benefits from every protocol the recipient applies, because each protocol is calibrated for a counterparty operating in good faith within a legitimate institutional framework — which the actor is not.

In some tiles the anti-counsel pressure is also applied directly. The Harvard University and University of Pennsylvania download tiles, both dated 4 February 2026, carry an identical postscript: “This is the direct result of advisors advising you against paying a ransom. It has the opposite effect. Do NOT provoke us again and pay the ransom when we contact you.” The borrowed register and the explicit anti-counsel argument are running on the same surface in parallel — the leak site speaks in the language of the institutions the victim would normally engage, and also tells the victim not to engage them.

The drafter’s reading list, and what they skipped

Read against the actual coursework on persuasive writing, the leak-site text is the work of someone who has internalised the macro-structure of legal and PR persuasion and has not yet read the chapter on register restraint. The Georgetown Law Writing Center’s Persuasive Writing handout — the standard reference taught to first-year law students, drawing on the canon used in legal-writing curricula (Diana R. Donahoe; Mary Ray and Jill Ramsfield’s Legal Writing: Getting It Right and Getting It Written; Ross Guberman’s Point Made; Linda H. Edwards’s Legal Writing: Process, Analysis, and Organization) — names two rules that the actor breaks consistently.

The first is avoid overly theatrical language. Georgetown is direct: “overly dramatic language can damage your credibility… A reader is far more likely to be persuaded if she comes to that conclusion herself.” The leak-site copy fails this. The “annoying (digital) problems” parenthetical wink, the “;)” emoticon on the welcome page, the “rooting your systems since ’19” tagline at the top of the site — each is the kind of theatrical flourish a first-year student inserts before learning that a serious document should not perform its own seriousness.

The same handout’s Maximize Presentation section names a discipline the leak site also fails: Proofread. “A sloppy document that is riddled with spelling, citation, or grammatical errors is less persuasive than a perfectly polished product.” The PRESS STATEMENT panel quoted above contains the misspelling inquries — preserved with [sic] in the quotation because the original is a primary-source artefact. The misspelling is also a small locator: the original inquries is the unfinished US form (inquiries), not the UK enquiries — consistent with the rest of the borrowed register, which is sourced from the US-American persuasive-writing and corporate-comms canons rather than the UK or civil-law equivalents. A drafter who had finished the proofreading chapter would have caught it. The persuasive document closes the credibility gap; the unproofread one re-opens it.

The second is keep your theory of the case subtle. Georgetown again: “the most effective theories are typically those that are never affirmatively stated. Rather, your goal is to set out the facts, organize your arguments, structure your paragraphs, and choose words according to your theory so that after she reads your document, the decisionmaker cannot help but understand why your client should win.” The they don’t care boilerplate is the actor stating the theory directly, in the most conclusory possible terms. A trained advocate would let the listed deadlines, the unanswered offers, the failure to reach an agreement do the work of conveying the theme. Saying they don’t care is the rookie equivalent of writing clearly in a brief — and Georgetown specifically warns against that conclusory move: “These conclusory words may undermine your credibility.”

Where the they don’t care line might pass alone, in several tiles the discipline collapses further. The Match Group tile reads, in part: “Don’t be an idiot like this company… Get off your moral high horse… PAY OR LEAK otherwise you’ll be made an example of.” The Betterment tile compares: “they value your privacy and peace of mind lower than the price of a roll of toilet paper.” The Rockstar Games tile closes with: “How does it feel to be the headline?” These are not the language of a serious organisation under media pressure; they are the language of a heckler. A trained advocate would let the dollar amount and the failed offer carry the argument and would never end the document on a smirk. Each smirk costs the borrowed register more than the smirk gains.

The same gap is visible at the level of persuasion theory more broadly. Petty and Cacioppo’s Elaboration Likelihood Model distinguishes the central route of persuasion — appeals through facts, evidence, and reasoning — from the peripheral route — appeals through credibility cues, presentation, and situational pressure. The borrowed register is a peripheral-route move: the actor is using the cues of legitimate professional documents to bypass critical evaluation. But the theatrical breaks corrode the peripheral cue at the moment the actor most needs it. A reader who has clocked the holding-statement template will also clock the gangster brand line at the top of the same site, and the cognitive distance the borrowed register was meant to collapse re-opens.

Cialdini’s six compliance shortcuts — reciprocation, commitment and consistency, social proof, likability, authority, and scarcity — provide a second lens. The actor invokes four of the six competently. Authority comes through the borrowed registers. Social proof comes from the public victim list. Commitment is engineered through the staged deadline mechanism. Reciprocation appears in the “all the chances and offers we made” framing. The two missing shortcuts are revealing. Likability — documented as one of the strongest persuasion drivers — is left on the floor; the actor consistently chooses sneer (“they don’t care about their clients nor investors”) over rapport. Scarcity is invoked but undermined by the constant cycle of fresh “FINAL WARNING” tiles, each diluting the urgency of the others. A reader processing a single tile feels a deadline; a reader processing the leak site as a whole sees a routine of deadlines, which is the opposite of scarcity.

The drafter has internalised invention, disposition, and arrangement — the first three of the classical five canons of rhetoric named in the Rhetorica ad Herennium — and has not yet attended to style and delivery, the latter two. The reading list is incomplete in a recognisable pattern. Whoever drafts the leak-site text knows enough about persuasive writing to mimic its macro-structure, and not enough to maintain its register. This matters for the audit reader for one specific operational reason. The text is persuasive, in the sense that it does recruit the reader’s professional-document processing infrastructure. But it is less persuasive than it could be. A more disciplined drafter — one who had finished the syllabus — would be substantially more dangerous.

What an audit needs to read for

For a corporate audit framework that takes breach communications seriously, three readiness items follow.

First, the breach-response communications protocol needs to anticipate that incoming actor communications will arrive in formats that recruit familiar professional processing. Counsel reading a demand-letter-format extortion document needs to be calibrated for the form-recognition response that will trigger automatically and to interrupt that response before it shapes the substantive evaluation. The protocol should flag the form as a borrowed register and require an explicit reset to crisis-response handling rather than routine pre-litigation handling.

Second, the press-handling layer needs to anticipate parallel publication by the actor in formats that will be quoted alongside the organisation’s own statements. The communications response plan should be drafted with the actor’s likely simultaneous output in view — including holding statements, public-tribunal pleadings, and acknowledgment-tracking tiles — and should not assume the news cycle will be shaped by the organisation’s release schedule. The actor’s publishing tempo is independent and faster.

Third, the executive briefing materials prepared for board members and incident-response leadership need to include explicit framing about the rhetorical structure of the documents they will read. The instinct to read a demand-letter-format document as a demand letter, and a justification-narrative-format document as a finding of fault, is exactly the rhetorical effect the actor intends. Naming the form is the fastest way to neutralise its effect on decision-making.

The conventional audit treats breach communications as an output of incident response — what the organisation says publicly and to regulators after the breach is detected. The 2026 extortion economy makes the actor’s communications an input the audit must read. The form of those communications is, increasingly, the form of legitimate professional correspondence. Reading the form, and reading where the form is failing, is part of the audit.

Sources

This piece extends the analysis in Reading the Ransom Note: The 2026 Extortion Economy in the Actors’ Own Words (PI Solutions, 3 May 2026; updated 9 May 2026). Leak-site quotations are reproduced from publicly distributed ShinyHunters tiles dated April–May 2026; onion-service URLs, victim contact identifiers, unique negotiation tokens, and verification artefacts are redacted. No links to active criminal infrastructure are provided.

Persuasive-writing canon referenced

• Georgetown Law Writing Center — Persuasive Writing handout (2019, revised by Catherine Carulas), drawing on Diana R. Donahoe (TeachingLaw.com); Mary Ray and Jill Ramsfield, Legal Writing: Getting It Right and Getting It Written; Ross Guberman, Point Made: How to Write Like the Nation’s Top Advocates; Linda H. Edwards, Legal Writing: Process, Analysis, and Organization; Michael Smith, Advanced Legal Writing: Theories and Strategies in Persuasive Writing.
• Demand-letter format and ingebrekestelling — the standard pre-litigation correspondence structure taught across common-law and civil-law jurisdictions; the Dutch civil-law form is governed by articles 6:81–6:83 of the Burgerlijk Wetboek.
• Holding-statement template — the formal early-cycle response form taught in public-relations and corporate communications coursework.

Persuasion theory referenced

• Five Canons of Rhetoric — invention, disposition, style, memory, delivery — from the Rhetorica ad Herennium (anonymous, c. 80 BCE; long attributed to Cicero) and Aristotle’s Rhetoric.
• Elaboration Likelihood Model — Richard E. Petty and John T. Cacioppo, central- vs peripheral-route persuasion (1980s).
• Cialdini’s six compliance shortcuts — reciprocation, commitment and consistency, social proof, likability, authority, scarcity — from Robert B. Cialdini, Influence: The Psychology of Persuasion.

The mapping above is original to this piece.