We Know You Can Pay a Million: Inside the Dark Economy of Hacking and Ransomware: LONGLISTED FOR THE FT BUSINESS BOOK OF THE YEAR AWARD 2026

by Anja Shortland

LONGLISTED FOR THE FT & STANDARD CHARTERED BUSINESS BOOK OF THE YEAR AWARD

Cybercrime is everywhere. A multibillion-pound industry run by wily hackers and fraudsters bankrupting businesses, stalling governments, stealing sensitive data. You could be next. Are you ready?

'Brilliant, original and authoritative. An extraordinary book that will change the way you think about ransomware and the digital ecosystems that surround us' PETER FRANKOPAN, bestselling author of THE SILK ROADS

'A fascinating book about one of the great scourges of the modern world' OLIVER BULLOUGH, bestselling author of MONEYLAND

'The history is fascinating... Shortland describes brilliantly the battle between the black hat - bad - and white hat - good - hackers... The revelations are so good' SUNDAY TIMES

You've heard the stories. Frozen IT systems, error codes everywhere, a pulsating pop-up pay up, or lose everything. With new attacks hitting the headlines every day, ransomware is recognised as a serious threat to global security and the economy, yet it remains a slippery and little understood phenomenon.

From a leading expert in illicit trading, We Know You Can Pay a Million spotlights the criminal underworld where organised groups trade stolen information and cryptocurrencies, and reveals the fascinating hidden histories of the superhackers whose activities have potentially catastrophic consequences for us all.

Genres: Nonfiction

302 pages, Kindle Edition

First published April 9, 2026

Reviews

[Mindaugas Mozūras · Rating 2 out of 5]

We know you can pay a million.

Each year, I read a number of books from the Financial Times Business Book of the Year longlist. I don't love all of them, of course, but I can usually understand why each book made the list.

This is one of the rare cases where I struggled to see it.

We Know You Can Pay a Million feels like a surprisingly shallow overview of hacking, cybercrime and ransomware. It covers a lot of ground, but rarely stays anywhere long enough to say something particularly interesting or insightful.

The beginning especially left me wondering who exactly the book was written for. It spends time recounting bits of early Apple history and the story of Kevin Mitnick. Those stories that have been told many times before and feel quite distant from the book's supposed focus on the economics of ransomware.

There are interesting pieces throughout, particularly when the book gets closer to how the ransomware economy actually functions: how victims are selected, how demands are set, how payments are negotiated, and how criminal organisations build enough trust to make an inherently untrustworthy market work.

Not a bad introduction to the subject for already steeped in tech, but for a book selected for the FT Business Book of the Year longlist, I expected considerably more.

[Bryony · Rating 3 out of 5]

This is a decent overview of ransomware, its history and roots from about 1970 to how it has grown into a massive global issue in 2026. The cost of business Vs the cost of paying their demands, how this affects everyone from their personal data to their finances, and how this is everyone's problem. There is a lot here ranging from law enforcement, politicians and the gangs of cyber criminals themselves. I particularly enjoyed learning about the evolving environment and the step up in sophistication and technology used from the 1970s to present day.

[Cold · Rating 3.5 out of 5]

This was a good synthesis of modern ransomware, and an incomplete and abbreviated history of hacking.

The best part of the book is the historical development of cybercrime across:
- Young and Jung's initial cryptoviral ransomware paper outlining the business model, and Joseph Popp's weird public awareness campaign
- A suspiciously long gap where ransomware was never tried for almost twenty years. This is where I would've expected serious historical research to identify early extortion schemes that succeeded/failed and why. Identifying these groups would've allowed Shortland to actually prove her theory on the necessary conditions of ransomware
- The world of breach forums, credit card hacks, and money mules. This ecosystem was presented as unprofitable and tricky because criminals have to trust each-other on the validity of cards (e.g. that they're not sold multiple times), and then fraudsters have to painstakingly go about cashing out via identity theft, health insurance fraud etc. Ransomware is presented as a more efficient and profitable alternative. While this is true, more time could've been spent on why these "traditional" cybercrime continue. E.g. investment fraud represents a greater financial loss than ransomware to this day.
- The Zeus malware strain that spanned botnet and credit card theft, how it left the owners drowning in funds and struggling to cash out. After a takedown of the original malware strain, a successor GameOverZeus was transitioned to ransomware as the CryptoLocker model was born. This extorted victims instead of stealing information.
- The history of ransomware through RaaS, big game hunting, and the post-2021 fragmentation.

Shortland was best when writing about the criminal business model and the trust it relies upon: a mix of ransomware operators, affiliates, developers and later initial access brokers. The question of how they manage reputation among victims (as you only pay an extortionist who'll actually decrypt or delete your data) and also trust between criminals as many operators disappeared once an affiliate struck gold with a multi-million dollar payment. Another interesting thread is when ransomware groups essentially have to provide IT support to make sure victims get back online.

The response side was also interesting. Victims thought they were avoiding paying the criminals by using third-party payment mills that could magically recover systems. It turned out those payment mills were just paying the ransomware actors for the decryption key and then using it to recover on the victim's behalf. I felt like this theme could've been drawn out better. Payment firms are paid a % of the ransom, which hardly incentivizes negotiating well. It's also interesting in light of this month's revelations that many leading ransomware negotiation firms were actually working with ransomware actors.

I also felt a proper evaluation of the ransomware business model was lacking. What slows the crime? Shortland identifies factors including lack of trust between criminals, victims lacking trust that the payment will be honoured, takedowns of criminal IT infrastructure, arrests of individuals, seizures of crypto funds, the work of the ransomware taskforce etc. But we don't really hear an evaluation of what moves the needle, not least because there's no explanation of the defender side. Why are some victims able to resist initial access, others able to recover from backups, and some forced to pay the criminals? Is it individual morals? Technical preparation? The importance of reputation in each industry?

I enjoyed reading the book, but it was a fairly shallow history that stitched together what is already known. There could've been a lot more original research.

[Cat · Rating 5 out of 5]

We Know You Can Pay a Million is a compelling and eye-opening exploration of ransomware, cybercrime, and the hidden economies behind digital extortion.

Anja Shortland examines the structures and incentives driving modern hacking networks with clarity and depth, making a complex subject both accessible and engaging.

Overall, it is a timely and fascinating nonfiction work that will strongly appeal to readers interested in cybersecurity, technology, and the evolving realities of the digital world.

[Rhonda · Rating 4 out of 5]

An interesting insight into a world I know little about from personal experience (thankfully). It also showed how the basic principles of business also work in the dark economy - doing what you say, understanding willingness to pay, requiring intermediaries, trust, and the need to innovate.

[John Smith · Rating 5 out of 5]

Audiobook was excellent. Well narrated. Interesting stories.