Skip to content
Cyber Unboxed
Ransomware

Double Extortion: When Locking Your Files Is Only Half the Threat

Modern ransomware often steals data first. Restoring from backup fixes the locked files, but not the threat to publish what was taken.

2 min readIntermediate Jul 31, 2026

Explain Like I'm Not a Hacker

It is a burglar who locks you out and also photographs your diary, so getting the door fixed does not end the threat.

The 30-second explanation

The attacker locks your files and also takes a copy. Even if you can restore from backups, they can still threaten to leak what they stole.

How it works

  1. 1

    1. Access

    Attackers get in and explore quietly.

  2. 2

    2. Steal

    Valuable data is copied out first.

  3. 3

    3. Encrypt

    Systems are locked and a note is left.

  4. 4

    4. Threaten

    Payment is demanded to unlock and to stay quiet.

Before encrypting anything, the attackers spend time inside the network finding valuable data and copying it out. Only then do they encrypt. The ransom note now carries two demands: pay to unlock, and pay to keep the stolen data private. This changes the defender's decision, because good backups solve the availability problem but not the confidentiality one. The strongest defence is to catch the intrusion earlier, while data is still being gathered.

Real-world example

An organisation restores its systems from backups within days. Weeks later it receives a message showing samples of files copied before the encryption, with a threat to publish the rest. The backups solved one problem, but the data had already left.

How to spot it

  • Large outbound transfers

    Unusual volumes of data leaving to unfamiliar destinations.

  • Archive tools on servers

    Compression utilities running where they normally do not.

  • Cloud storage upload tools

    Sync or transfer tools installed on servers.

  • Activity before the lock

    Days of unusual access ahead of the encryption.

What to do

  1. 1Monitor for unusual outbound data, not just for encryption, so you can catch the theft stage.
  2. 2Keep offline backups, but plan for the data-leak scenario as well as the recovery one.
  3. 3Prepare legal, communications and customer-notification steps before an incident.

Stay curious. Stay safer.

This is one piece of a bigger picture. Explore more real-world examples, concepts and tips to build your cybersecurity awareness.

Explore More

Keep reading