Your Company’s Data Is for Sale on the Dark Web. Should You Buy It Back?

The article addresses the risks and considerations for companies contemplating purchasing their own stolen data from the dark web, a marketplace for illicitly obtained information. It highlights that buying back such data poses significant legal, regulatory, and reputational risks, including increased exposure to cyber extortion, potential violations of U.S. sanctions enforced by the Office of Foreign Assets Control (OFAC), and the possibility of acquiring compromised or mixed data containing proprietary information from other entities. The article advises that such purchases should be extremely rare and conducted with caution, including thorough OFAC compliance checks, while emphasizing that buying unrelated stolen data is inadvisable due to similar risks.