Leaked email from HBO hacker shows network offered $250,000 payoff as 'bug bounty'

The hacker behind the cyberattack against US television network Home Box Office (HBO) was allegedly offered a $250,000 (£192,827, €212,702) payoff disguised as a 'bug bounty' reward, according to an email showing a conversation between the criminal and a senior technology executive.

A screenshot of the conversation, dated 27 July 2017, was sent to US outlets including Variety and The Hollywood Reporter this week (10 August), with the HBO staffer stating the network had "been working hard [...] to review all of the material that you have made available to us".

It was on 31 July, four days after the correspondence, that HBO first confirmed it had been hit with a so-called "cyber incident". Later, material was posted to a (now defunct) website that included unaired episodes of Ballers and scripts for Game Of Thrones.

The image of the leaked email suggests that negotiations have been ongoing for some time, with the network attempting to delay the release of its content.

"In the spirit of professional cooperation, we are asking you to extend your deadline for one week," the email stated, according to The Hollywood Reporter.

"As a show of good faith on our side, we are willing to commit to making a bug bounty payment of $250,000 to you as soon as we can establish the necessary account and acquire bitcoin," it added, referencing the type of reward typically provided to legitimate researchers.

"We also have not been able to put into place the necessary infrastructure to be able to make a large payment in bitcoin, although we are taking steps to do so," the exec allegedly added. At the time of writing, it remains unclear if any cryptocurrency was ever transferred.

One inside source told Variety that the email was "worded that way to stall for time" as the network scrambled to understand exactly what had been compromised. The email was sent under the name 'Mr Smith', the same pseudonym the hacker used in previous messages.

On Tuesday 8 August, it emerged that the hacker had sent a video message to HBO's chief executive, Richard Plepler, demanding millions of dollars in ransom. The culprit later released 3.4GB of files which reportedly included a month's worth of company emails.

Within the leaked files, one document was said to contain the phone numbers and home addresses of multiple members of the Game Of Thrones season 7 cast. In previous statements to the press, Plepler has played down the scope of the attack and the disclosure of emails.

He said: "Any intrusion of this nature is obviously disruptive, unsettling, and disturbing for all of us.

"I can assure you that our senior leadership and our extraordinary technology team, along with outside experts, are working round the clock to protect our collective interests. The problem before us is unfortunately all too familiar in the world we now find ourselves a part of."