Double extortion ransomware steals sensitive data before encrypting systems, then demands payment to prevent a leak and to restore access. In 2025-2026 it drove a large share of breaches and insurance claims, hit healthcare and small businesses hardest, and calls for offline backups, strong authentication, and fast patching. CISA explains in its StopRansomware advisory that attackers copy data first, encrypt second, and threaten to publish stolen files on a leak site unless paid. That second threat keeps pressure on victims even when they can recover encrypted systems.
Table of Contents
- How does the second threat work?
- What did the Gunra attacks show?
- Who is most affected?
- What should organizations do now?
How does the second threat work?
Attackers enter through phishing, exposed services, or unpatched edge devices. They locate valuable files, copy them out, then encrypt local systems. Victims face two losses at once: locked operations and possible public exposure.
Coalition reports that dual-extortion incidents with both encryption and data theft made up 70% of ransomware insurance claims it handled in 2025-2026, as described in the Coalition report coverage. Refusing to pay for decryption does not remove the leak threat. Paying does not guarantee deletion of stolen data.
What did the Gunra attacks show?
Gunra is a ransomware-as-a-service operation active since April 2025 and derived from Conti code. Coverage of the joint CISA, FBI, and NSA advisory in CISO Intelligence reporting says it listed 51 victims, mostly in Australia, East Asia, and Europe.
The same reporting says Gunra gains entry by exploiting internet-facing Fortinet FortiOS and FortiProxy flaws CVE-2024-55591 and CVE-2025-24472. It then moves laterally inside the network before data theft and encryption. The pattern shows why edge-device patching and internal segmentation matter.
Who is most affected?
Ransomware appeared in 44% of all breaches in Verizon's 2025 data breach report and 48% in the 2026 edition, including 88% of breaches at small and medium businesses, according to Halcyon's DBIR analysis. Small firms often lack backups, spare staff, and network separation. One interrupted system can halt billing, care, or orders.
Healthcare and public health was the most-targeted U.S. critical-infrastructure sector in 2025, with hundreds of ransomware attacks plus 182 reported data breaches. Hospitals hold records that cannot easily change, such as medical histories and identity data. Leaked health data creates fraud, privacy, and safety risks beyond the ransom itself.
What should organizations do now?
FBI Internet Crime Complaint Center data for 2025 cite over 3,600 ransomware complaints, losses above $32 million, and 63 new variants. Those dollar figures exclude downtime, wages, and remediation, so they undercount harm, while CISA guidance summarized by Security Today urges tested backups, strong authentication, prompt edge-device patching, and segmentation.
- Keep offline, encrypted backups and test restores regularly.
- Require phishing-resistant multifactor authentication for remote access and administrator accounts.
- Patch internet-facing devices quickly, especially VPNs, firewalls, and proxies.
- Segment networks to slow movement from one machine to many.
You Might Also Like
- Royal Ransomware Update 2026: Disclosure, Response, and Open Questions
- Tech Company Data Breach News Explained for 2026: Who It Affects, Key Evidence, and What to Do Next
- Clop Ransomware FAQ: Notifications, Rights, and Protection