# What is double extortion in ransomware?

Double extortion means the attackers both encrypt your systems and steal a copy of your data, then demand payment for two things: the decryption key and a promise not to publish the data. It became common around 2020 and is now the norm: CISA and FBI advisories describe it for most current groups, including Black Basta, Akira, Play and Rhysida. Some groups skip encryption entirely and extort only with stolen data, as the advisory on BianLian describes from 2024 onwards. The practical consequence is that good backups solve only half the problem: they get you running again but do nothing about the stolen data, which may trigger GDPR notification and duties towards customers. It also means the theft happens before the encryption, often over several days, which gives defenders a window. Large outbound transfers to unfamiliar destinations are one of the signals NetSenX flags on every plan.

FAQ: [Ransomware groups and families](https://netsenx.com/en/faq/ransomware-families) · https://netsenx.com/en/faq/what-is-double-extortion-ransomware

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/blog/2026-10-24_ransomware-protection

## Related questions

- [What is a ransomware leak site?](https://netsenx.com/en/faq/what-is-a-ransomware-leak-site)
- [Where can we find official information about ransomware groups?](https://netsenx.com/en/faq/where-to-find-official-ransomware-advisories)
- [What is No More Ransom, and can it decrypt our files?](https://netsenx.com/en/faq/what-is-no-more-ransom)
- [What does a police takedown of a ransomware group mean for victims?](https://netsenx.com/en/faq/what-does-a-ransomware-takedown-mean-for-victims)
- [Why do ransomware groups change their names?](https://netsenx.com/en/faq/why-do-ransomware-groups-rebrand)