Update: The Conti threat group terminated negotiations with JVCKenwood late last week and published their data on the group’s leak blog. This action was due to the chat between JVCKenwood and Conti being reported to journalists, resulting in articles being published in the midst of negotiations. Conti released an announcement on their blog on October 10, 2021, that included two (2) new key rules regarding the aftermaths of their ransomware attacks. Conti explained, in the first rule, that “if we see a clear indication of our negotiations being sent to the media we will terminate the negotiations and dump all the files on our blog” in order to protect their reputation. The second rule emphasized that “If we see our chats in public we will also dump your files. If this happens after the ransom is already paid by the target who shared the chats, we will dump somebody else’s files as retaliation”. Conti explained further that they do not care if the chats were shared due to security researchers/journalists extracting the chats from a VirusTotal sample or gaining them directly from the victim. JVCKenwood has yet to release a statement confirming a data breach of customer data, and CTAPT will provide an update on the incident once JVCKenwood reveals additional information.