The Mysterious Case of the Missing Trump Trial Ransomware Leak

This week, the notorious ransomware gang known as LockBit threatened a kind of disruption that would have been a first even for a criminal industry that has crippled hospitals and triggered the shutdown of a gas pipeline: leaking documents from the criminal prosecution of a former president and presidential candidate.

Then, without explanation, that threat evaporated, leaving plenty of unanswered questions behind.

For the past five days, LockBit promised on its dark-web site to publish data stolen from the Fulton County, Georgia, government, which it listed as one of its extortion victims, unless the county paid an unspecified ransom. One administrator for the group went so far as to post the specific threat of releasing documents related to Fulton County's high-profile prosecution of Donald Trump: the Superior Court of Fulton County is the venue where Trump, the Republican presidential front-runner, stands accused of a criminal conspiracy to interfere in the 2020 election.

Yet when the hacker group's own deadline for that leak arrived, no documents appeared. Instead, LockBit mysteriously removed any mention of it from its website. Fulton County officials have denied paying a ransom—which leaves unanswered why the leak disappeared, and whether LockBit still holds any of the court's documents or ever did in the first place.

“We’re not aware of any data having been released today so far,” Fulton County Commission Chairman Robb Pitts said in a Thursday afternoon press conference. “Now that being said, that does not mean the threat is over by any means, and they could release whatever data they have at any time, today, tomorrow or any time in the future. We have no control over that."

The ransomware crew's threat, before it vanished, had been dramatically timed: It followed a coordinated law enforcement takedown operation targeting LockBit just last week. Known as Operation Chronos and led by the UK's National Crime Agency, the operation took control of much of LockBit's infrastructure, seized hundreds of its cryptocurrency wallets, tore down the dark-web sites it uses in its extortion campaigns, and even claimed to have compromised some of its members and partners.