Cyber extortionists’ ransom demands have surged in recent years, as ransomware cotinues to cripple the operations of manufacturers, hospitals, and — most recently — local governments.

Yet those demands may have hit an upper limit.

On September 4, Mayor Jon Mitchell of New Bedford, Mass., announced that the town refused to pay a $5.3 million ransom demand to the operator that had infected municipal systems with a variant of Ryuk. Instead, the city responded with a $400,000 counteroffer, which would have been paid from an insurance reimbursement and “consistent with ransoms recently paid by other municipalities,” Mitchell said during a press conference.