Double Extortion Ransomware: Why Backups Aren't Enough

A double extortion ransomware attack is extremely serious. Criminals first copy the organization's data before encrypting it. Then, they demand money twice. First for the decryption key, and second to not publish what they stole. The backup strictly solves the first problem.

The second problem remains intact, no matter how good the backups are. From a cybersecurity auditor's perspective, this double extortion ransomware trend makes many defense plans written five years ago completely incomplete and outdated.

What has changed compared to classic attacks?

In the old form, files suddenly became unreadable. Only a ransom note appeared on the screen. Organizations with a working backup simply restored their systems and moved on.

The new tactic of cybercriminals

Attackers quickly noticed that more and more victims were completely refusing to pay. Therefore, they added a vital stage. This is called exfiltration: copying data out of the network well before encryption. This makes double extortion ransomware threats far more complex.

Data confirming the global trend

According to the Statista study, approximately 1,500 attacks resulting in data exposure were recorded in 2020. In 2021, there were approximately 2,700 cases. We are talking about an enormous increase of over 80% in a single year. This marks exactly the moment when publishing data became a standard practice.

Another very important benchmark is the year 2023. In the incidents carefully analyzed by the Sophos X-Ops team, classic formats represented 70.13% of all cases. Interestingly, data extortion without encryption already represented 7.14%. There are already new attacks where nobody encrypts absolutely anything, they just steal and blackmail.

How does a double extortion ransomware attack unfold?

Below are the stages as perceived by an ordinary company. This is a simple map of signs, not a complicated technical manual.

The main infiltration stages

• System entry
  An email or remote access account without MFA enabled is often used. Other variants are a reused password or an outdated service exposed to the internet. It is rarely a spectacular attack.
• Consolidation of position
  The attacker creates additional accounts and searches for administrator accounts. He learns the whole network. This can take weeks. Good monitoring would immediately spot logins at unusual hours and massive accesses.

Data theft and blackmail

• Data exfiltration
  Truly valuable data (contracts, customer databases, personnel files) are archived. Then they are transferred out of the organization. To a firewall without alerts, everything looks like simple higher outbound traffic.
• Encryption and the note
  Only now does the victim find out the truth. The longer the previous stages were, the more details the note contains about what the hackers stole.
• Constant pressure
  If the amount is not paid, the publication of samples follows. Then entire archives appear. Sometimes, the victim's clients are contacted directly by the attackers.

What does an incident look like from inside the company?

Here is a real, but completely anonymized case. A distribution company with 60 employees restores everything from backup in just three days. It considers the incident totally closed. However, after two weeks, a client receives an unexpected email. It contains his own contract attached and a clear question if he knows his data is circulating freely.

The difference between availability and confidentiality

The company had absolutely not notified the data protection authority. Their excuse was: "we restored everything". Here you see the major difference between an availability incident and a confidentiality one. The second one does not automatically end when the systems restart.

Public incidents in Romania in 2026 perfectly illustrate the first face. At ANCPI, the attack led to the deletion of approximately 1,000 virtual servers. At ANP, the July 29 attack led to the isolation of equipment. The question "what data was copied beforehand" is always the hardest.

Warning signs you can easily recognize

There are always a few clear clues announcing an imminent disaster in the network. Pay attention to these details to prevent double extortion ransomware.

• Successful logins from locations or at times unrelated to the company's schedule.
• New administrator accounts that absolutely no one remembers creating.
• Unusual outbound traffic, especially at night or during the weekend.
• The antivirus suddenly deactivates "by itself" on one or more systems.
• Backup processes start failing totally for no reason a few days before the attack.

Effective controls and the blocked stage