What is double extortion in ransomware?

Double extortion means the attackers both encrypt your systems and steal a copy of your data, then demand payment for two things: the decryption key and a promise not to publish the data. It became common around 2020 and is now the norm: CISA and FBI advisories describe it for most current groups, including Black Basta, Akira, Play and Rhysida. Some groups skip encryption entirely and extort only with stolen data, as the advisory on BianLian describes from 2024 onwards. The practical consequence is that good backups solve only half the problem: they get you running again but do nothing about the stolen data, which may trigger GDPRGDPR: General Data Protection Regulation. The EU data protection law (Regulation (EU) 2016/679). notification and duties towards customers. It also means the theft happens before the encryption, often over several days, which gives defenders a window. Large outbound transfers to unfamiliar destinations are one of the signals NetSenX flags on every plan.

← All 25 questions on Ransomware groups and familiesAll topics