Extortionware: When Hackers Ransom Your Data AND Threaten to Leak Your Files

In a typical extortionware attack, criminals don’t just encrypt your data—they exfiltrate it first, transferring copies to their own servers. Then they issue a double-barreled threat: pay us or (1) your data remains encrypted, AND (2) we’ll publish your sensitive information for the world to see.

This evolution nullifies what was once the standard defense against ransomware: backups. Even if you can restore your encrypted files from backup, the threat of leaked data remains.

Why Extortionware Is Booming in 2025

Extortionware has seen explosive growth this year for several key reasons:

• Higher payment rates: The fear of data exposure dramatically increases the likelihood victims will pay up. According to recent findings, extortionware victims are significantly more likely to pay than those facing traditional ransomware.
• Ransomware-as-a-Service (RaaS): The criminal underground has industrialized, with specialized groups offering extortionware capabilities as a service to less technically skilled criminals.
• Advanced exfiltration techniques: Today’s attackers have developed sophisticated methods to steal massive amounts of data quickly and quietly before encryption begins.
• Public leak sites: Ransomware groups now maintain dedicated “name and shame” websites where they publish victims’ stolen data, adding credibility to their threats.
• Operational sophistication: Groups like RansomHub and Medusa operate with business-like efficiency, employing professional negotiators and specialized technical teams.
  • UPDATE: RansomHub went offline April 1, 2025, splintering into new and rival groups

Recent Extortionware Trends

The first quarter of 2025 has shown some alarming developments in extortionware tactics:

• Physical threats: Some groups have begun mailing threatening letters to executives claiming they’re preparing to leak sensitive data, adding real-world intimidation to digital threats.
• Multiple extortion layers: Beyond the initial double extortion, some attackers now demand a third payment to delete the stolen data or a fourth payment to prevent DDoS attacks on the victim.
• Industry targeting: Manufacturing and financial services remain primary targets, though healthcare and education have seen increased attacks this year.
• Cross-platform attacks: Modern extortionware can target both Windows and Linux environments, leaving few systems safe from attack.

Protecting Yourself from Extortionware

Since backups alone won’t save you from extortionware threats, here are seven simple steps anyone can take to protect their personal data:

1. Use Strong, Unique Passwords Everywhere: Create different passwords for each of your accounts and use a password manager to keep track of them. This prevents hackers who breach one account from accessing all your others.
2. Enable Two-Factor Authentication: Add this extra security layer to all your important accounts. Even if someone gets your password, they’ll still need the second verification step (usually a code sent to your phone) to get in.
3. Be Cautious with Email and Messages: Think twice before clicking links or opening attachments, even from people you know. Hover over links to see where they actually lead before clicking, and verify unexpected requests from friends or colleagues through a separate channel.
4. Keep Your Devices Updated: Those annoying update notifications? They often contain critical security fixes. Set your devices to update automatically overnight so you’re always protected.
5. Back Up Your Data Securely: While backups won’t stop data leaks, they’re still crucial. Use encrypted backup options and keep at least one backup disconnected from the internet completely.
6. Check Your Privacy Settings: Review and tighten privacy settings on all your social media accounts and apps. Limit what personal information is visible to others and what data apps can access.
7. Have a Personal Response Plan: Know what you’ll do if you’re compromised. Save contact information for your bank, credit card companies, and identity protection services. Consider setting aside emergency funds in case you need professional help recovering from an attack.

Remember, the goal isn’t just to keep hackers out—it’s also to limit how much damage they can do if they get in. Taking these steps won’t make you hack-proof, but they’ll make you a much harder target for extortionware criminals.

Protecting Your Organization from Extortionware

Since you can’t rely solely on backups to recover from extortionware, prevention becomes essential. Here are crucial steps to protect your organization:

1. Implement Zero Trust Architecture: Adopt the principle that no user or application should be inherently trusted. Access should be granted based on identity and context, with strict verification at every step.
2. Deploy Data Loss Prevention (DLP): Implement technologies that can detect and block unauthorized data exfiltration attempts before they succeed.
3. Encrypt Sensitive Data: Ensure your most sensitive information is encrypted at rest and in transit, making stolen data useless without decryption keys.
4. Secure Remote Access Points: VPN credentials are frequently targeted entry points. Implement multi-factor authentication and regularly audit access logs.
5. Enhance Employee Training: Since extortionware frequently begins with phishing or social engineering, regular security awareness training remains essential.
6. Segment Networks: Limit lateral movement by dividing networks into isolated zones, preventing attackers from accessing all systems once they breach one entry point.
7. Develop an Incident Response Plan: Create a detailed plan specifically addressing extortionware scenarios, including communications strategies and decision frameworks around potential payments.

Extortionware—A Growing Trend

The rise of extortionware represents a significant shift in online threats that affects everyone. While traditional ransomware only locked up your personal files, extortionware both locks your data AND threatens to expose your private information—making it a far more personal and damaging threat for everyday people.

The cybersecurity reality of “not if, but when” matters more than ever for individuals. Preparing for these threats requires creating consistent personal habits that build protection into your digital life, from how you create passwords to how you share information online.

Has Anyone You Know Been Threatened by Extortionware?

Have you, or has someone you know, been exposed to extortionware? What happened? How did they manage it? Share your thoughts below

Website Power Tip: Find Cybersecurity Answers in Seconds

Need specific cybersecurity guidance? Use the Search Box on the top right corner of the Adventures of a Sage home page to quickly discover all those cybersecurity tips you always wanted to know about (but were afraid to ask). It’s a treasure trove of jargon-free advice!

The Sage’s Invitation

The path to digital security is a shared endeavor. Join me—share your thoughts on the cyber challenges you foresee in 2025 below. Together, we can navigate this landscape with wisdom and care to block the bad actors.  Sign up for email alerts using the form below.

PS—If you don’t see the signup form below, your browser is blocking the form with its security settings, or with a plugin. Here’s an alternate form to get you subscribed.