Threat Intelligence · 2 min read
Ransomware Groups Are Shifting to Data Extortion Without Encryption
Encrypting a victim's files takes time and leaves forensic evidence. Increasingly, ransomware groups skip it entirely and go straight to exfiltration-and-extortion.
Encryption-based ransomware has a real cost for the attacker: it's noisy, it's slow relative to exfiltration, and modern backup and recovery practices have made "pay to get your files back" a weaker lever than it used to be. A growing share of ransomware-adjacent groups have adapted by dropping the encryption step entirely and extorting victims purely on the threat of publishing stolen data.
Why this changes the calculus
This shift means "we have good backups" is no longer sufficient as a ransomware defense narrative on its own — data exfiltration prevention and detection matter just as much as recovery capability now.
What this means for incident response
- Data-loss-prevention and egress monitoring deserve the same investment historically aimed at backup and recovery.
- Incident response plans need a real answer for "attacker claims to have exfiltrated data" that doesn't assume encryption already happened.
- Regulatory breach-notification triggers (GDPR, state breach laws, sector-specific rules) generally key off unauthorized access or exfiltration, not encryption — this shift doesn't reduce notification obligations at all.