I believe the strategy is usually to demand an amount that is enough to be annoying but not so much that it is prohibitive. Ideally, the target is willing to quickly pay the money to unlock their systems.

> The manager said it was cheaper and faster for the hotel to just pay the Bitcoin.

Yep, you want something the manager of the local enterprise can authorize out of his petty cash - not something he has to call the CEO in on for a decision.

Even better if the guy tries to hide it out of fear of being fired for incompetence - which is the general way these things go.

Seemed low as as well, but making it too high would have meant the hotel might have just called a locksmith to break the locks and then decided to replace the system.

Any good parasite knows not to disturb the host system too much.

It's a useful way to, say, speculating wildly, provide an honest signal to someone not convinced of your hacking capabilities that you've actually got the technical skills claimed.

Now ... if only I could think of, say, some geopolitically significant hospitality enterprise, possibly with widespread or global operations, against which such a proven attack might be of interest.

> They only wanted 1,500 EUR? That seems like an awfully low number for something this serious.

Besides the argument of picking a sum that makes it relatively easy for a business to cough up, this is 1500 EUR tax-free. https://en.wikipedia.org/wiki/List_of_European_countries_by_... lists average net monthly income in Austria as 2000 EUR; pull something like this off twice a month and you're doing fine.

It's not "tax free", it's illegal income to which tax is a pretty orthogonal concern. You have to consider a fairly high discount on any non-trivial illegal income, as there are many things you can't do with it without laundering them first (which is very expensive to do at scale).

If you ask for too much you'll have serious law enforcement coming after you. Ask for only a little bit and the focus is more on the fact that the hotel was idiotic for letting this happen then it is on the hackers.

Especially with the standard policy of "we do not negotiate". That policy is really hard to justify when the amount is so small compared to the damage of delaying payment.

Don't forget the back door they put in, they were going to repeat this a few times by the sound of it.

They were very smart to make it that low. At that cost, it becomes a simple no-brainer for the hotel, because it's cheaper than even just one booking refund. It also means it's very low priority for law enforcement.

That's my first reaction too. While I'm not condoning this action... 10x that.