Double Extortion

Double extortion is a ransomware strategy in which attackers steal a copy of the victim's data before encrypting systems, then demand payment under two separate threats: pay to regain access to your systems, and pay to prevent the stolen data from being published or sold. The technique, popularized by the Maze group in late 2019 and standard across major ransomware operations since, was a direct answer to better backups — an organization that can restore its systems still cannot restore the secrecy of exfiltrated data.

How it works

The intrusion usually begins with a human-layer compromise: a phishing email, stolen credentials bought from an initial access broker, or a social-engineered help desk. Once inside, the operators move laterally, escalate privileges, and quietly carry out data exfiltration — contracts, employee and customer records, financials, anything with leverage — before triggering the encryption that announces the attack. The ransom note then points to a "leak site" where the group publishes victim names and sample files, with a countdown to full publication. Variants stack further pressure: threatening to notify regulators, customers, or journalists; contacting executives directly; or adding DDoS attacks (sometimes called triple extortion). Some groups now skip encryption entirely and extort on the stolen data alone, because the leak threat is the part that reliably gets paid.

How to defend against it

Backups remain necessary — they neutralize the encryption half — but the exfiltration half must be fought earlier in the chain. That means hardening the entry points (phishing-resistant MFA, simulation-tested employees, strict help desk verification), detecting the pre-encryption phase (unusual outbound transfer volumes, access to file shares outside a user's pattern, new admin accounts), and limiting what any one compromised account can reach through least privilege and segmentation. Because the clock starts at first access, a rehearsed response matters as much as prevention: our guide to incident response for social engineering breaches covers containing the human-layer compromise that double extortion almost always begins with. Treat the leak threat in advance, too — know where your sensitive data lives, encrypt it at rest, and decide before an incident who calls regulators, customers, and counsel.