From Encryption to Extortion: The Ransomware Shift to Data Theft- Should you worry less?
Ransomware attacks have long been synonymous with encrypted files and frozen systems. Victims of these attacks often faced an impossible choice: pay the ransom or lose access to their data forever.
But a new trend in cybercrime is taking shape, one that shifts the focus from locking data to stealing it outright. This evolution is forcing organisations to confront an unsettling reality: even when systems remain unaffected, the consequences of a ransomware attack can be devastating.
The New Ransomware Playbook
Gone are the days when ransomware attacks primarily relied on encryption as their weapon of choice. Increasingly, cybercriminal groups are adopting a new approach: data exfiltration followed by extortion.
Instead of encrypting files, attackers infiltrate systems, steal sensitive information, and then threaten to release it on dark web marketplaces if their demands aren’t met.
This tactic offers several advantages to cybercriminals:
Broader Pressure Points: By stealing sensitive data, attackers can target not just the victim organisation but also its customers, partners, or clients.
Lower Complexity: Data exfiltration is less technically challenging than deploying and maintaining effective encryption software.
Increased Ransom Success Rates: Victims may be more willing to pay when the threat extends to reputational damage, regulatory fines, or legal liabilities.
Should you worry less?
The shift to data theft means organisations can no longer rely on traditional defences designed to thwart file encryption.
Even a fully operational system is little comfort when sensitive customer records, proprietary research, or strategic plans are in the hands of criminals.
This development also complicates incident response, as the stolen data can be monetised or leaked months after the attack.
Recent Examples of Data-Theft-Only Ransomware
One notable example of this trend is the BianLian ransomware group. Initially employing a double-extortion model that combined data theft with file encryption, BianLian recently dropped the encryption component entirely. Now, their attacks focus exclusively on data exfiltration, with ransom demands tied to the threat of public exposure.
But BianLian isn’t alone. Groups like Karakurt and SnapMC have also adopted similar tactics, relying on data exfiltration without deploying ransomware payloads. These examples highlight a broader evolution across the ransomware ecosystem.
What Organisations Can Do
To protect against these emerging threats, organisations need to pivot their cybersecurity strategies. Here’s how:
Enhance Data Monitoring: Deploy tools to track and monitor data transfers. Anomalies in data flows can indicate unauthorised exfiltration.
Segment and Encrypt Data: Even if attackers steal your data, encryption renders it useless without the decryption keys.
Strengthen Access Controls: Use multi-factor authentication (MFA) and strict privilege management to limit attackers’ ability to move laterally within your network.
Develop Incident Response Plans: Prepare for the eventuality of a data theft attack by planning how to communicate with stakeholders, customers, and regulators.
Implement Robust Backup Strategies: While backups don’t protect against data theft, they remain critical in recovering from traditional ransomware attacks that include encryption.
The Bigger Picture
This shift in tactics underscores a broader evolution in cybercrime. As organisations improve their defences against traditional ransomware attacks, threat actors are adapting, exploiting new vulnerabilities, and diversifying their methods.
The rise of data theft extortion is a stark reminder that cybersecurity must evolve as quickly as the threats it aims to counter.
Closing Thoughts
Ransomware is no longer just about encrypting files—it’s about weaponising your data.
As criminals pivot to extortion based on stolen information, organisations must prepare for a new reality. The stakes are higher, the risks are greater, and the need for proactive, forward-thinking defences has never been clearer.
Contact us today to learn how we can help protect your organisation from the growing threats of data theft and extortion.