In one sentence: Double extortion is when ransomware attackers both lock your files and steal your data, then threaten to publish it, so backups alone cannot make the problem go away.

What it is

CISA’s #StopRansomware guide explains that criminals adjusted their tactics over time. Besides encrypting systems and demanding a ransom for decryption, they exfiltrate victim data and pressure victims to pay by threatening to release it. Using both tactics is known as double extortion.

CISA adds that in some cases attackers steal data and threaten to release it as their only form of extortion, without ransomware at all. The NCSC likewise warns that attackers will threaten to publish data if payment is not made.

How it works

1. The attacker gets in, often through access sold by an initial access broker. CISA’s Medusa advisory says Medusa actors typically recruit brokers on criminal forums to get access.
2. They move through the network and copy data out.
3. They deploy ransomware and encrypt systems.
4. They leave a note with instructions, often through an anonymous chat site. CISA says Medusa operates a data leak site that lists victims with countdowns.
5. They add pressure. CISA says Medusa contacts victims by phone or email if they do not respond, and Play actors have phoned victims, including help desks, to push for payment.
6. If unpaid, the data is threatened with publication or sale.

Why backups are not enough: restoring files does not un-steal the data.

Who it affects and how badly

Any organisation holding data worth leaking: client files, staff records, health records, contracts or designs. Accountancy and legal practices hold confidential client data. Care providers and schools hold safeguarding and health information. Manufacturers hold designs and supplier terms. Fintech and insurers hold financial data. MSPs hold data from many clients.

CISA noted Medusa had affected over 300 victims across critical infrastructure sectors as of February 2025.

The worst case adds to ransomware’s downtime a data breach: regulator reporting within 72 hours under UK and EU GDPR, fines, claims and lost clients. Smaller firms may find the leak harms them more than the outage.

Real examples

British Library, October 2023. The Library’s own review says the Rhysida attack exfiltrated data, encrypted or destroyed substantial portions of its server estate, and locked out all users. Source: https://cdn.sanity.io/files/v5dwkion/production/99206a2d1e9f07b35712b78f7d75fbb09560c08d.pdf

Medusa, CISA advisory. CISA describes how Medusa encrypts victim data and threatens to release exfiltrated data, operates a leak site, and has hit over 300 victims. Source: https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a

How to detect it

• Watch for large or unusual outbound transfers before any encryption. Data theft comes first.
• Look for new admin accounts, unusual VPN logins and tools used for bulk copying. CISA lists newly created accounts and anomalous VPN logins as leads.
• Alert on backup, shadow copy or boot configuration changes.
• Review cloud storage and mail logs for mass downloads or forwarding rules.
• Treat a phone call from a stranger about “stolen data” as a possible active extortion.
• In Microsoft Defender or Google Workspace alerts, enable data exfiltration and mass download alerts.

How to fix or prevent it

1. Reduce what can be stolen: delete data you do not need and encrypt sensitive stores.
2. Keep tested offline backups for the encryption half of the problem.
3. Use MFA on all remote access, and patch internet-facing systems.
4. Segment the network and limit admin rights so attackers cannot reach everything.
5. Monitor outbound traffic and large downloads. The NCSC points to logging and protective monitoring.
6. Prepare a data breach plan: know who decides, who tells the ICO within 72 hours, and who tells customers.
7. Plan for contact by phone as well as email.
8. Note CISA and the FBI do not encourage paying, as payment does not guarantee recovery.

Related terms

• ransomware
• triple extortion
• data exfiltration
• initial access brokers
• ransomware as a service
• personal data breach and the ICO 72-hour rule
• trojan
• indicators of compromise
• infostealer malware

Browse the full Resources library.

FAQ

What is double extortion? Encrypting systems and also stealing data, then threatening to publish it unless paid, as CISA describes.

Do backups solve it? Backups help with encryption, but not with stolen data being published.

Do I have to tell the regulator? If personal data is affected and the risk to people is likely, UK GDPR requires telling the ICO within 72 hours of becoming aware.

How Wolfcore helps

Wolfcore’s ransomware readiness assessment shows how far an attacker would get and what you would lose, and our SOC monitoring keeps watch after the test. See Wolfcore pricing.