Cybersecurity

What Is Double Extortion Ransomware?

Double extortion is the ransomware tactic that made backups alone insufficient. Attackers first steal your data, then encrypt your files — and demand payment twice: once to unlock your files, and once to stop them publishing what they stole. This guide explains how it works, why it changed the ransomware business, and what actually protects you now.

By Abdul Hannan · Published 14 November 2026 · Updated 14 November 2026

How double extortion works

A double extortion attack has two phases. In the first, the attacker gets into the network — usually through phishing, a stolen password, or an unpatched system — and quietly spends days or weeks finding the valuable data: customer records, financial files, medical records, internal emails, intellectual property. They copy it out to their own servers. This is the exfiltration phase, and it happens before anything is locked.

In the second phase, the attacker encrypts the victim's files and leaves a ransom note. But the demand is now twofold: pay to get the decryption key, and pay to stop the stolen data being published. The threat is made concrete by a leak site — a website run by the ransomware group where they publish samples of the stolen data, count down to a full release, and list victims who have not paid.

The sequence is deliberate. By the time the victim discovers the encryption, the data is already gone. The backup restores the files, but it cannot un-steal the data. That shifts the victim's choice from a technical question — can we recover? — to a reputational and legal one: what happens if this data becomes public?

Why attackers added the second threat

Attackers added extortion because encryption alone was losing its power. As more organisations started keeping good backups, the ransom demand stopped working — victims simply restored their files and walked away. The groups needed a lever that backups could not defeat, and stolen data was it.

The leak site is also a marketing tool. Publishing a victim's name and a sample of their data puts pressure on them from customers, journalists, regulators and competitors, all at once. Some groups go further, contacting the victim's customers directly or offering the data for sale to anyone interested. The threat is not just that the data will be published, but that it will be used.

The business model has grown around this. Ransomware groups now run leak sites like a press office, with professional pages, countdown clocks, and even customer support channels for victims who want to negotiate. The presentation is professional; the business is extortion.

Who gets hit, and what gets stolen

Double extortion is aimed mainly at organisations with data worth threatening to publish: healthcare providers with patient records, law firms with client files, manufacturers with designs and contracts, schools with children's records, and any business holding customer data. But the tactic is spreading downwards, and smaller organisations are increasingly caught by the same groups or by their affiliates.

What is stolen depends on what the attackers find: names, addresses, payment details, health records, passwords, internal emails, financial documents, and source code. Even data that seems unimportant — internal emails, meeting notes, staff directories — can be damaging when published, because it exposes how the organisation works and who to target next.

Individuals are affected too, usually as the customers or patients whose data is published, rather than as the direct target. When a company you use is hit by double extortion, your data may be among what is published — which is why the breach guidance in this section matters even if you are not the victim.

Triple extortion and the escalation

Some groups have added a third pressure: contacting the victim's customers, partners or suppliers directly, telling them their data was stolen, and threatening them too. Others launch a distributed denial-of-service attack against the victim's public website during negotiations, to add disruption to the pressure. This escalation is sometimes called triple extortion.

The pattern is worth naming because it shows the direction of travel: the attack is no longer only about the victim's files. It is about the victim's relationships — with customers, with regulators, with the public. That is why communication planning, including what to tell affected people and when, is now part of ransomware preparation.

The escalation also means the damage spreads. A single attack can lead to fraud against the victim's customers, regulatory investigations, and long-term reputational harm that outlasts the technical recovery by months or years.

What actually protects you now

Backups still matter — they are the difference between losing your files and losing only your data — but they are no longer the whole answer. The defences that matter against double extortion are the ones that stop the attacker getting in and the ones that catch them while they are quietly exploring. Multi-factor authentication on email and remote access, prompt patching, and phishing training close the common entry points.

Detection matters more than ever. The exfiltration phase takes days or weeks, which is time to catch it: unusual large transfers of data, logins at odd hours, new accounts, disabled security tools. Organisations that monitor for those signs can stop an attack before the encryption phase. Small organisations can get the same benefit from managed security services and from simple alerts — a warning when a large amount of data leaves the network, or when a new administrator account appears.

Data hygiene helps too: do not keep data you do not need, limit who can access sensitive data, and encrypt sensitive data at rest. The less an attacker can find, and the less they can read if they find it, the weaker the second threat becomes.

• Backups defeat the encryption. Detection defeats the theft.
• Multi-factor authentication and patching close the entry points.
• Watch for quiet signs: odd-hour logins, large data transfers, new accounts.
• Keep only the data you need, and limit who can reach it.

If you are hit by double extortion

Do not pay — the advice from law enforcement is the same as for any ransomware, and it is stronger here, because payment has been known not to guarantee the data is deleted: there is no way to verify that stolen data has been destroyed, and the same data may be sold later anyway. Report the attack to law enforcement — in the US, the FBI Internet Crime Complaint Center at ic3.gov; in the UK, Action Fraud and the National Cyber Security Centre — and take legal advice quickly.

Assume the stolen data will be published and plan accordingly. Work out what was taken, who is affected, and what your notification duties are — in many jurisdictions you must notify regulators and the people affected within a set time. Be honest with those people about what happened and what they should do: change passwords, watch for fraud, be wary of phishing that uses their stolen details.

Restore from backups onto clean systems, change credentials from a clean device, and review how the attacker got in so the same path is closed. Keep the ransom note and the attackers' messages as evidence, and do not delete logs. The recovery is longer than a simple encryption attack, because the breach response continues after the systems are back.

Sources

• CISA — Ransomware guidance — last checked 14 November 2026.
• National Cyber Security Centre (UK) — Ransomware guidance — last checked 14 November 2026.
• No More Ransom — Free decryption tools — last checked 14 November 2026.
• FBI Internet Crime Complaint Center — IC3 — last checked 14 November 2026.

Last checked: 14 November 2026.

Frequently asked questions

What is double extortion ransomware?

Double extortion ransomware steals your data before encrypting your files, then demands payment twice: once for the decryption key, and once to stop the stolen data being published on the group's leak site.

Why are backups not enough against double extortion?

A backup restores your files, but it cannot un-steal data that was copied out before the encryption. The attacker still holds the stolen data and can publish or sell it, which is the second half of the threat.

What is a ransomware leak site?

A leak site is a website run by a ransomware group where they publish samples of stolen data from victims who have not paid, with countdowns to a full release. It is used to pressure victims and to advertise the group to future targets.

What is triple extortion?

Triple extortion adds a third pressure to the attack — for example, contacting the victim's customers directly about their stolen data, or launching a denial-of-service attack on the victim's website during negotiations.

Should I pay to stop my data being published?

Law enforcement advises against paying. There is no way to verify that stolen data has been deleted, and the same data may be sold later. Report the attack, take legal advice, and notify the people affected through the proper channels.