Ransomware used to be simple: encrypt your files, demand payment, and (hopefully) give you the decryption key. That model is now outdated. In 2026, almost every serious ransomware group uses double extortion and many have moved to triple or even quadruple extortion.
The core idea is brutally effective: they don’t just lock your data. They steal it first, then threaten to leak or sell it if you don’t pay.
What Double Extortion Actually Looks Like
Stage 1 – Data Theft (The “Exfil” Phase) Before encrypting anything, the attackers quietly copy sensitive files. They target:
a) Customer databases and PII
b) Financial records and contracts
c) Intellectual property and source code
d) Emails and internal communications
e) Employee HR files
This phase can take days or weeks. They move slowly and quietly to avoid detection.
Stage 2 – Encryption (The Traditional Part) Once they have the data, they deploy the ransomware and encrypt files across the network. At this point, you have two problems: you can’t access your systems, and the attackers have a copy of your most sensitive information.
Stage 3 – The Double Threat The ransom note now contains two demands:
a) Pay to get the decryption key (so you can restore operations)
b) Pay (usually more) to prevent the leaked data from being published on their leak site or sold on the dark web
If you refuse, they start releasing samples of the stolen data publicly to increase pressure.
Why Ransomware Groups Switched to Double Extortion
1. Encryption alone is no longer enough Many organizations now have good backups. They can restore systems without paying. Double extortion removes that safety net, even with perfect backups, the leaked data can still destroy reputation, trigger regulatory fines, or lead to lawsuits.
2. Higher payouts Groups can demand significantly more money because the stakes are higher for the victim.
3. Public pressure works Publishing stolen data on leak sites creates external pressure from customers, partners, regulators, and the media. Many victims pay just to stop the leaks.
4. It works even against well-prepared organizations Companies with strong backup strategies and incident response plans are still vulnerable because of the data theft component.
Real-World Impact in 2026
Double extortion has become the standard. When a group like Qilin, Black Basta, or any of the active RaaS (Ransomware-as-a-Service) operations hits a target, the leak site is updated within hours of encryption. Victims often face simultaneous operational downtime and the threat of public data exposure.
Some groups have gone further into triple extortion:
1. Encrypt all systems
2. Threaten to expose the data publicly
3. Conduct DDoS (Distributed Denial of Service) attacks against the victim's public web properties to increase pressure
What This Means for Defense
Due to the reality of double extortion as being highly focused on the theft of data, how to defend against this type of attack will change as follows:
1. Implement strong network segmentation to limit lateral movement along with restricting discovery of additional data
2. Utilize advanced data loss prevention (DLP) tools that monitor for abnormal levels of activity related to transferring out of users’ accounts
3. Adhere strictly to least-privilege access policies and perform regular access permission audits
4. Perform early reconnaissance monitoring for signs of abnormal reconnaissance behavior (e.g. Active Directory enumeration, abnormal file access patterns).
5. Having an incident response plan that assumes data has already been stolen
Encryption can be recovered from with good backups. Data theft cannot.
Double extortion has fundamentally changed the ransomware game. It’s no longer just about getting your files back, it’s about protecting your reputation, customer trust, and regulatory compliance at the same time.
The groups that master data theft alongside encryption are the ones dominating the ransomware landscape today.
