Ransomware gangs have shifted from simply encrypting a victim’s files to stealing data first and threatening public release, a change in tactics that has made paying a ransom a far less reliable way to make an incident actually go away.
Ransomware attacks have evolved from a straightforward extortion model, where attackers encrypted a victim’s files and demanded payment for the decryption key, to a double-extortion approach that also steals sensitive data before encrypting anything, threatening public release of that data as separate leverage even if the victim has working backups and doesn’t need the decryption key at all.
That shift has undermined one of the more reliable defenses organizations built against the earlier ransomware model: maintaining robust, isolated backups. Good backups still prevent the need to pay for a decryption key, but they do nothing to prevent stolen data from being published if a ransom isn’t paid.
Paying doesn’t guarantee the data actually gets deleted
Security researchers and law enforcement agencies caution that even organizations that do pay a ransom in a data-theft case have no reliable guarantee the attackers will actually delete the stolen data rather than sell it separately or use it for further extortion later, since there’s no enforcement mechanism to hold a criminal group to that promise.
“Paying used to at least get you your files back with reasonable certainty. Paying for stolen data to disappear is a promise from a criminal with no way to enforce it.”
Security teams have responded by shifting investment toward preventing initial network intrusion and data exfiltration in the first place, rather than relying primarily on backup and recovery strategies that address only the encryption half of a threat model that’s grown considerably more complicated.
