Double Extortion Ransomware: Data Theft Before Encryption

Double extortion transformed ransomware from a pure availability problem into a confidentiality and regulatory crisis. In a double-extortion attack, the operator exfiltrates sensitive data before deploying the encryptor, then threatens to publish the stolen data on a leak site if the ransom is unpaid. Even organisations with perfect, tested offline backups face the prospect of public disclosure of customer records, financial data, and trade secrets.

First observed widely with Maze in late 2019, the tactic is now universal across RaaS operations. It shifted the negotiation leverage decisively toward attackers: a victim that can restore systems from backup still has to weigh the cost of a data-breach notification, regulatory fines (GDPR, HIPAA, state breach laws), and reputational damage against the ransom demand.

A further evolution — triple and quadruple extortion — adds DDoS attacks against the victim's public services and direct extortion of the individuals whose data was stolen (patients, customers). The defensive priority therefore expands beyond recovery to data minimisation, exfiltration detection, and network segmentation that limits what an attacker can stage and steal.