Ransomware Groups Are Shifting to Data Extortion Without Encryption
Encrypting a victim's files takes time and leaves forensic evidence. Increasingly, ransomware groups skip it entirely and go straight to exfiltration-and-extortion.
October 21, 2026
v1
2 min
Ransomware Groups Are Shifting to Data Extortion Without Encryption
Encryption-based ransomware has a real cost for the attacker: it's noisy, it's slow relative to exfiltration, and modern backup and recovery practices have made "pay to get your files back" a weaker lever than it used to be. A growing share of ransomware-adjacent groups have adapted by dropping the encryption step entirely and extorting victims purely on the threat of publishing stolen data.
What this means for incident response
- Data-loss-prevention and egress monitoring deserve the same investment historically aimed at backup and recovery.
- Incident response plans need a real answer for "attacker claims to have exfiltrated data" that doesn't assume encryption already happened.
- Regulatory breach-notification triggers (GDPR, state breach laws, sector-specific rules) generally key off unauthorized access or exfiltration, not encryption — this shift doesn't reduce notification obligations at all.
Related Articles
Two of the most consequential software supply-chain compromises on record share a root cause that most vendor-risk programs still don't test for.
A near-lapse in the CVE program's federal funding in 2025 was a real wake-up call about how much of global vulnerability management runs on a single point of failure.
Push-notification MFA fatigue — spamming a user with approval requests until they tap 'approve' out of frustration — keeps working against organizations that have already deployed MFA correctly.