If there's an engineer who can pull this off why are they screwing around with ransomware? Have them send me their resume, if they can deploy code to our frontend transparently without customers or devops having to spend time or even noticing it we'll happily pay them more than they're asking for in ransom.

Edit : thinking about it, this story doesn’t add up. Doesn’t this mean the client must have a copy of the decryption key, meaning any cached client would render the ransom demand worthless? It’s just also so much easier, if someone has that level of access, to make a copy of the database, encrypt it, then blow away the old one. Doing a silent deploy of client code with no one noticing seems way harder.