Ransomware built its fearsome reputation on encryption: files scrambled, systems frozen, operations stopped until a ransom bought the key. A growing share of attacks now skip that step entirely. The intruders break in, quietly copy the most sensitive data they can find, and leave. The demand that follows is simpler and in some ways colder: pay, or the data is published. Backups, the classic defence against encryption, are no defence at all against a leak.
Security firms tracking the shift say it reflects criminal economics. Encryption is noisy, technically demanding and increasingly well defended; it also attracts maximum attention from law enforcement. Exfiltration is stealthier, works even against organisations with excellent recovery plans, and monetises the one asset no backup can restore: confidentiality. Incidents surveyed on our homepage increasingly involve victims whose systems never stopped running at all.
Double Extortion Becomes Single, Sharper Extortion
The leak-only model grew out of double extortion, in which gangs encrypted and stole data, threatening publication to defeat good backups. Dropping encryption trims the operation to its most profitable half. Victims face regulators, customers and litigation rather than downtime, and negotiators report that the threat of a drip-feed release, sample files posted first, then larger tranches, is designed to keep pressure rising for weeks.
The targets reflect the logic. Healthcare providers, law firms, councils and any business holding rich personal or commercial records offer the most leverage, because their data harms third parties when published. Coverage by BBC News and Reuters of recent cases shows victims wrestling publicly with the same dilemma: paying criminals offers no guarantee of deletion, while refusing means watching stolen records circulate. Security agencies consistently advise against payment, noting that deletion promises are unverifiable and payment funds the next attack.
Defence Moves Upstream
If the damage is done at the moment of theft, defence must happen earlier. The practical agenda is unglamorous and familiar: patch the edge devices intruders favour, enforce multi-factor authentication everywhere, segment networks so one foothold cannot reach file stores, and watch for the bulk data movements that precede a demand. Data minimisation has become a security control in its own right; records that were deleted on schedule cannot be stolen. Our tech section returns to that point often, because retention policies are written by lawyers and tested by criminals.
Detection deserves special attention. Encryption announces itself; exfiltration whispers. Security teams are investing in monitoring for unusual transfers, new archive files on servers and access to data stores outside normal patterns. Incident response plans are changing too: legal counsel, regulators and communications specialists now join the first call, ahead of the forensic engineers who once led it.
A Crime Model That Suits Its Moment
Leak extortion also fits a world of strict breach-notification law. Where disclosure is mandatory, criminals time threats to regulatory deadlines and media interest, turning compliance itself into leverage. Some groups now contact victims’ customers or patients directly, multiplying the pressure. It is extortion adapted to transparency, and it helps explain why reported ransom payments and reported incidents have diverged: many events now surface as data breaches first and crimes second.
The counterweight is collective. Information sharing between sectors, faster patching of known flaws and genuine consequences for negligent data hoarding all raise the cost of the model. Encryption may never disappear, since chaos still has its uses for criminals. But the centre of gravity has moved, from locking data up to threatening to let it out, and defence budgets are moving with it. Organisations that adapt earliest, by protecting data before it can be stolen rather than merely restoring systems afterwards, will be best placed as this quieter, colder form of extortion becomes the criminal norm.
