Double extortion is a ransomware tactic where attackers steal a victim's data before locking it, then threaten to leak the stolen files publicly unless a ransom is paid. It adds a second pressure point beyond encryption: even a victim who restores systems from backup still faces the threat of a public data dump. The tactic is now standard practice, not an edge case. The joint #StopRansomware Guide from CISA, the FBI, NSA, and the Multi-State Information Sharing and Analysis Center (MS-ISAC) defines double extortion as actors stealing data before or during encryption and threatening to release it to force payment, on top of the ransom demanded for a decryption key, as the StopRansomware Guide explains.
Table of Contents
- How Double Extortion Differs From Traditional Ransomware
- How Common Is Data Theft in Ransomware Attacks Now?
- Is Paying the Ransom Still Worth It for Victims?
- What Happens When Victims Don't Pay — The MOVEit Example
- Watch for Secondary Scams Targeting Double-Extortion Victims
How Double Extortion Differs From Traditional Ransomware
Traditional ransomware encrypts files and demands payment for the decryption key. The only leverage is restoring access, so a victim with clean backups can often ignore the demand entirely. Double extortion removes that escape route. Attackers copy sensitive files out of the network before triggering encryption, then threaten to publish or sell that data regardless of whether the victim pays for decryption.
The StopRansomware Guide notes that some groups have gone further and skip encryption altogether, stealing data and threatening to leak it as their only extortion method — meaning a victim can face this threat with no files ever locked. This shift matters for incident response. Restoring from backup addresses encryption, but it does nothing about data already copied to an attacker's servers. The decision facing a victim is no longer just "can we recover," it's "can we contain exposure of what was already taken.".
How Common Is Data Theft in Ransomware Attacks Now?
Data theft now accompanies the large majority of ransomware incidents. Coveware's Q3 2025 Ransomware Report found exfiltration occurred in more than 76% of the cases it handled that quarter, confirming that theft-based pressure now rides alongside encryption in most attacks rather than appearing as an occasional add-on, according to Coveware's Q3 2025 report. The FBI's Internet Crime Complaint Center (IC3) logged 3,611 ransomware complaints in 2025, causing more than $32 million in reported losses — up sharply from 3,156 complaints and about $12 million in 2024.
Akira, Qilin, INC, BianLian, and Play were the most-reported ransomware variants, and healthcare was the hardest-hit critical infrastructure sector, with 278 recorded attacks, per the FBI's 2025 Internet Crime Report. Active groups keep this pressure visible to the public. Qilin, among the most active ransomware operations in 2026, runs a leak site on the Tor network where it posts stolen data from organizations that miss its payment deadline. Threat intelligence firm ZeroFox tracked 15 new Qilin victim listings across nine countries in just four days in June 2026, including Austrian aviation firm Avcon Jet, as detailed in ZeroFox's reporting on Qilin's victim spree.
Is Paying the Ransom Still Worth It for Victims?
Payment rates are falling, and theft-only attacks fare worse than encryption-based ones. Coveware recorded an overall ransom payment rate of just 23% in Q3 2025 — a record low — and only 19% among victims whose data was stolen without any encryption deployed, a sign that theft-only extortion carries less leverage than locking files outright, according to Coveware's Q3 2025 findings. Payment amounts have swung sharply in the same period.
The average ransom payment Coveware tracked fell 66% quarter-over-quarter to $376,941 in Q3 2025 (median $140,000), down from a Q2 2025 average of $1,130,070, before rebounding roughly 57% to about $600,000 in Q4 2025. That volatility suggests negotiated outcomes vary widely by case rather than following one stable pricing pattern, per Coveware's Q3/Q4 2025 data. Fewer victims paying does not mean the threat disappears once encryption is declined. A leaked dataset can still circulate, be resold, or trigger lawsuits years after the initial attack, which is the real cost double extortion imposes regardless of the ransom decision.
What Happens When Victims Don't Pay — The MOVEit Example
Clop's 2023 mass exploitation of a zero-day vulnerability in MOVEit Transfer software shows what theft-only extortion costs even without a single file encrypted. The campaign stole data from more than 2,300 organizations and triggered over 160 U.S. lawsuits, later consolidated into a multidistrict litigation in Massachusetts federal court, according to BankInfoSecurity's August 2025 coverage. Settlements from that single campaign have reached tens of millions of dollars.
Nuance, a Microsoft subsidiary, agreed in August 2025 to pay $8.5 million over data belonging to roughly 1.23 million patients. Separately, a Massachusetts federal judge gave final approval in April 2025 to a $2.8 million class-action settlement for Arietis Health, covering about 1.98 million people whose health data was exposed in the same MOVEit campaign, per HIPAA Journal's reporting. These outcomes illustrate that regulatory and litigation exposure from a theft-only breach can rival or exceed what a ransom payment would have cost. Organizations weighing a ransom decision should factor in downstream legal liability tied to the stolen data itself, not just the immediate ransom figure.
Watch for Secondary Scams Targeting Double-Extortion Victims
Double extortion has spawned its own follow-on fraud. A ThaiCERT advisory from August 2026 warned that fraudsters now impersonate "data deletion" services, offering to breach the original attacker's servers and erase leaked data on the victim's behalf, according to ThaiCERT's August 2026 advisory.
These services charge roughly $20,000 to $60,000 and exploit the fear double extortion has already created, with no verifiable way to confirm the leaked data was actually removed. Organizations contacted by such offers should treat them with the same scrutiny as the original ransom demand.
- Verify any "deletion service" claim through established incident response channels, not the service itself
- Assume data already published or sold cannot be reliably retracted
- Document the contact as a separate incident for law enforcement reporting, distinct from the original ransomware case
You Might Also Like
- Ransomware Groups Shift From Encryption to Data Theft Tactics
- Ransomware Recovery Risk Guide: Data Exposed, Fraud, and Identity Theft
- Teen Ransomware Suspect Allegedly Led Gang Behind Hundreds of Attacks