Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Double extortion is a ransomware tactic in which criminals steal data and encrypt systems, then demand payment while threatening to publish or sell the stolen information. Paying may help neither problem: it does not reliably produce a working decryptor or restored access, and it is not an enforceable promise that every copy of the data will be deleted.
Treat the incident as two linked but separate risks. Backups and restoration planning address the loss of availability caused by encryption. Data theft creates a confidentiality and notification problem that a decryptor or a restored server cannot undo.
What “double extortion” means
Traditional ransomware focuses on availability. An attacker encrypts files, servers or other systems and demands money for a decryption key. Double extortion adds a second pressure point: before, during or alongside encryption, the attacker copies sensitive information and threatens to release it if the victim does not pay.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →The CISA #StopRansomware Guide describes the combination of encryption and theft followed by a threat to release the data as “double extortion.” The sequence normally looks like this:
- Initial access: criminals obtain a foothold through a compromised account, exposed service, malicious attachment, vulnerability or another intrusion route.
- Discovery and collection: they identify valuable files, databases, credentials and systems, then transfer selected information outside the organization.
- Encryption: they disrupt operations by encrypting endpoints, servers, virtual machines or shared storage.
- Demand: they ask for money for a decryptor and add a deadline or threat to publish, sell or otherwise misuse the copied data.
Encryption is not required for an extortion threat. CISA also states: “In some cases, malicious actors may exfiltrate data and threaten to release it as their sole form of extortion without employing ransomware.” That data-only scenario is often called data extortion, but it creates the same central problem: information has left the victim’s control.
Why the two pressures matter
Encryption and exfiltration affect different business objectives. Encryption can stop employees, customers and systems from using information. Exfiltration can expose personal data, trade secrets, health records, credentials or regulated material even if a clean backup restores every affected computer. An incident can therefore be operationally recovered while remaining a privacy and security incident.
Can attackers still leak data after a ransom is paid?
Yes. The FBI states in its ransomware testimony, “On top of this, paying a ransom does not always keep data from ultimately being leaked.” That is a risk, not a prediction that every organization that pays will be exposed.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesThe copy already exists
Exfiltration normally happens before the ransom decision. By the time negotiators see a demand, the attacker may hold copies on several systems, in cloud storage or with other members of the criminal operation. A victim cannot reliably inspect those systems or prove that every duplicate has been destroyed. A promise to delete the data is therefore a voluntary assurance, not a privacy guarantee backed by a court or technical control.
Rank #2
Criminal incentives can change
An attacker may publish information, sell it to another criminal, use it for fraud or identity theft, or return to threaten the victim again. Different affiliates and ransomware groups follow different practices, and an apparent agreement with one participant may not bind another participant who obtained the files. Payment can also signal that the victim is willing to fund future attacks.
Payment does not guarantee recovery
The confidentiality question and the operational question must be answered separately:
| Question | What payment might be intended to obtain | Why the result is uncertain |
|---|---|---|
| Can systems and files be restored? | A decryption tool or key. | The tool may be missing, defective, incompatible with some files or never delivered. The UK National Cyber Security Centre (NCSC) says payment does not guarantee access to devices or data. |
| Will stolen information remain private? | A promise not to publish or sell the copy. | The attacker can retain, duplicate, sell or release information. The FBI warns that payment does not always prevent an eventual leak. |
| Will the incident end? | An end to the current demand. | Payment can encourage further extortion, and another actor may still possess the data or access credentials. |
A functioning decryptor, if one arrives, demonstrates only that some encrypted systems can be opened. It does not demonstrate that attackers erased their copies. Likewise, a verified backup can restore operations without changing what was exfiltrated.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What a victim should do during an active incident
Ransomware and data theft require coordinated incident response rather than an improvised payment decision. Use qualified incident-response and digital-forensics professionals where available, preserve evidence and follow the reporting and notification rules that apply to your jurisdiction and sector.
- Activate the incident plan and decision team. Identify the person responsible for technical containment, legal and privacy assessment, executive decisions, communications and contact with insurers or regulators. Record decisions and times.
- Contain access carefully. Isolate affected devices and networks in a way that does not destroy evidence. Do not broadly wipe systems or reset every account before responders can capture relevant logs and indicators.
- Preserve evidence. Keep ransom notes, messages, file names, timestamps, logs, system images and suspected attacker addresses. Evidence can support investigation, notification, recovery and law-enforcement reporting.
- Determine what happened. Establish which systems are encrypted, what data may have been copied, when access began, which accounts or credentials were used and whether the attacker still has a path into the environment.
- Report the crime. The FBI encourages ransomware victims to report whether or not they pay. Organizations outside the United States should use their national cybercrime or law-enforcement reporting authority; reporting routes and deadlines vary by country.
- Assess legal and contractual duties. Work with counsel and privacy specialists to determine whether personal, health, financial or confidential information was involved and whether regulators, customers, employees, partners or insurers must be notified.
- Plan communications. Give staff and affected parties a verified channel for updates. Avoid repeating unverified claims from an attacker’s leak site, and do not disclose investigative details that could help the intruder.
- Restore only from trusted sources. Verify that backups and replacement systems are clean, close the attacker’s access path and test restored services before returning them to normal use.
Do not treat this list as an instruction to negotiate with criminals or to pay. A payment decision has legal, sanctions, financial, operational and ethical consequences and should be evaluated with professional, jurisdiction-specific advice.
What backups can—and cannot—solve
The CISA and MS-ISAC Ransomware Guide recommends preparation, protected backups and tested restoration. A backup improves the chance of recovering availability; it does not pull a stolen copy back from an attacker.
Characteristics of a useful recovery copy
- Isolation: protect at least some copies from the normal network, administrator credentials and automated deletion paths so a compromise cannot encrypt or erase every copy.
- Testing: perform restoration exercises. A backup that has never been restored may be incomplete, corrupted, too slow or incompatible with current systems.
- Coverage: include the data, configurations, identity systems and applications needed to operate, not just user documents.
- Capacity and durability: retain enough historical versions and storage capacity for the organization’s recovery objectives, and protect the media from physical loss.
- Documented ownership: assign who can authorize restoration, where copies are stored, how credentials are recovered and how the process is recorded.
An external hard drive can support an offline copy when it is disconnected and secured after the backup. It is one component of a broader plan, not a guarantee against exfiltration, theft, hardware failure or poor restoration procedures.
| Backup capability | Problem it helps address | Problem it does not address |
|---|---|---|
| Clean, isolated copy | Restoring files and systems after encryption. | Removing data already copied by an attacker. |
| Regular restoration tests | Finding missing files, broken credentials or incompatible software before an emergency. | Preventing an attacker from publishing information. |
| Offline or otherwise protected storage | Reducing the chance that one network compromise encrypts every backup. | Proving that an exfiltrated copy was deleted. |
How to interpret leak-site claims and ransomware statistics
Attackers sometimes post a victim’s name or sample files on a leak site to increase pressure. A listing can be evidence that a group is making a claim, but it is not a complete record of all victims, all stolen data or the exact date of an intrusion.
In its LockBit advisory, CISA warns that the group’s leak-site observations represented only a portion of victims and were not a reliable indicator of attack timing. Do not turn a leak-site count into a worldwide victim total, a current trend line or a probability that a payer will be exposed. LockBit and RansomHub advisories describe particular actors; their behavior should not be generalized to every ransomware operation.
The FBI testimony America Under Cyber Siege: Preventing and Responding to Ransomware Attacks cited FBI Internet Crime Complaint Center figures showing a 20 percent increase in reported ransomware incidents and a 225 percent increase in reported ransom amounts in 2020 compared with the prior year. Those are historical, reported figures, not a current global prevalence rate and not a measurement of how many double-extortion victims ultimately had data leaked.
No comprehensive current statistic establishes the share of all double-extortion victims whose data is eventually published. The absence of a reliable percentage is itself a reason to avoid promises such as “paying guarantees privacy” or “every victim will be leaked.”
Common misunderstandings to avoid
- “We restored from backup, so the incident is over.” Restoration addresses availability. Investigate whether information was copied and whether credentials or access remain compromised.
- “The attacker promised deletion, so disclosure is impossible.” A promise cannot be independently verified or enforced against every person who may hold a copy.
- “The leak site proves the attacker stole everything.” Posts may be incomplete, exaggerated, delayed or fabricated. Treat them as an investigative lead, not a full inventory.
- “No encryption means no ransomware incident.” CISA documents data-only extortion in which attackers threaten release without encrypting systems.
- “A payment guarantees a decryptor.” The NCSC warns that payment does not guarantee access to devices or data.
- “Reporting is pointless if we paid.” The FBI encourages reporting regardless of whether payment occurred, and reports can help authorities connect related attacks.
Questions organizations should settle before an attack
Preparation is most useful when it turns an emergency into a sequence of known decisions. Document who can isolate systems, who can approve restoration, who contacts authorities, how evidence is preserved, how customers and employees are informed, and how backup access is recovered if ordinary credentials are unavailable.
Run restoration exercises and update the plan when systems, suppliers or legal obligations change. Include data-exfiltration scenarios, not only encrypted servers: the team should know how it will identify sensitive data, evaluate notification duties and respond to a threat to publish even when operations remain online.
FAQ
Does double extortion always involve both encryption and theft?
No. The usual definition combines the two tactics, but CISA records data-only extortion in which criminals steal information and threaten release without encrypting systems.
Can a decryptor prove that stolen data was deleted?
No. Decryption concerns access to affected systems. It provides no technical proof that an attacker destroyed every exfiltrated copy.
Should a leak-site listing be treated as a complete breach report?
No. CISA says leak-site observations for LockBit covered only part of that group’s victims and did not reliably show attack timing. Use a listing as one lead within a forensic investigation.
Does paying eliminate the need to report?
No. The FBI recommends reporting ransomware to the appropriate authority whether or not the victim pays. Organizations elsewhere should follow their own national reporting and regulatory requirements.
Frequently Asked Questions
If a company has good backups, is it protected from double extortion?
Backups can improve recovery from encryption, but they do not prevent data theft or guarantee that an attacker will not disclose an exfiltrated copy.
Is there a reliable percentage of double-extortion victims whose data gets leaked?
No comprehensive current percentage is established here. Leak-site counts cover only some victims and cannot be used to calculate an overall leak probability.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
