Also known as: data extortion · exfiltration extortion
Double extortion is a ransomware tactic in which attackers steal a copy of an organisation's data before encrypting it, so that refusing to pay risks both operational disruption and public release of the stolen information.
The tactic emerged as a direct answer to improved backup practices. When a victim could restore from backup and ignore the ransom, encryption alone stopped being leverage. Holding a copy of the data restores that leverage regardless of recovery capability.
It fundamentally changes the decision calculus during an incident. Paying no longer buys a decryption key so much as an unverifiable promise of deletion, and disclosure obligations often trigger on the data theft alone — meaning the incident is reportable whether or not a ransom is paid.
Ransomware
Ransomware is malicious software that denies an organisation access to its own data — historically by encrypting it — and demands payment in exchange for restoring access or withholding publication of stolen data.
Ransomware-as-a-Service
Ransomware-as-a-service (RaaS) is a criminal business model in which ransomware developers lease their malware and infrastructure to affiliates, who carry out the actual intrusions and share a percentage of ransom proceeds with the operators.
Data Exfiltration
Data exfiltration is the unauthorised transfer of data out of an organisation's environment by an attacker, typically the final objective of an intrusion.
Incident Response
Incident response is the structured process an organisation follows to detect, contain, eradicate, and recover from a security incident, and to learn from it afterwards.