Double extortion ransomware is an attack in which criminals steal a copy of an organisation's data before encrypting its systems. They then demand payment twice over: once for a key to unlock the encrypted files, and again to stop them publishing or selling what they took. Restoring from backups deals with the first threat but does nothing about the second. That's why double extortion has become the standard model for ransomware groups.
This guide explains how double extortion works, why backups alone won't save you, what the attack looks like as it unfolds, and the controls that reduce the damage.
How double extortion ransomware works
Early ransomware simply encrypted files and asked for payment. Organisations with good backups could restore and refuse to pay, so criminal groups adapted. Today a typical attack has two payloads, and the theft comes first.
- Initial access. Stolen or guessed credentials, a phished account, or an unpatched VPN, firewall or other internet-facing system.
- Establishing control. Creating new accounts or taking over existing ones, then gaining administrative rights.
- Lateral movement and discovery. Using built-in tools such as remote desktop, PowerShell and remote execution utilities to find file servers, databases and backups.
- Data theft (exfiltration). Compressing valuable data and copying it out using legitimate file-transfer or cloud-sync tools.
- Recovery sabotage. Deleting shadow copies, wiping or resetting backup storage, and disabling security tools.
- Encryption. Deploying the ransomware across as many systems as possible, usually at night or over a weekend.
- Extortion. A ransom note points to a chat portal. If the victim won't pay, samples of the stolen data are posted on a leak site, followed by the full set.
Some groups add further pressure: phoning executives, emailing the victim's customers, or launching denial-of-service attacks. This is sometimes called triple extortion.
A current example: SafePay
In October 2026, US, German and UK agencies published a joint advisory, AA26-293A, on the SafePay ransomware group, which they say has hit at least 600 organisations since August 2024. Its playbook is textbook double extortion. It steals documents before encrypting, deletes shadow copies, and resets network-attached storage that holds backups. The ransom demand is pitched as a share of company revenue, and the group publishes stolen data if a victim refuses to pay. A representative may also phone the victim to add pressure (The Record). We cover how to hunt for SafePay's behaviour in our threat research post.
Why backups alone won't save you
Backups are essential, and you should still invest in them. But in a double extortion attack they only answer half the problem:
- Backups restore availability, not confidentiality. Once data has left your network, no restore brings it back under your control.
- Backups are a target. Attackers look for backup servers and storage before they encrypt anything, specifically so you can't recover. Exploited backup-server vulnerabilities feature in recent ransomware advisories.
- Regulatory obligations still apply. If personal data was taken, UK GDPR breach-notification duties can apply whether or not you restore. The ICO expects you to report a notifiable breach within 72 hours of becoming aware of it.
- The leak can arrive weeks later. Customers, partners and staff may learn about the breach from a leak site rather than from you.
So the useful question is not only "can we restore?" but also "would we notice data leaving, and how quickly?"
The window before encryption
The good news in double extortion is that theft takes time. Attackers have to find the data, stage it and move it out, and that leaves evidence. Signs a SOC can catch before encryption:
- Many failed logons followed by a success on a VPN or remote desktop service.
- New administrator accounts, or existing accounts added to privileged groups.
- Remote execution or remote support tools appearing on servers where they've never run.
- Archiving tools (7-Zip, WinRAR) compressing large volumes of files on a file server.
- File-transfer or sync tools (RClone, FileZilla, cloud storage clients) making large outbound transfers.
- Security software being disabled or tampered with.
- Shadow copy deletion. This is usually the last step before encryption and should be treated as an emergency.
None of these is proof of an attack on its own. In sequence, on the same systems, they describe one.
How to reduce the damage
Make initial access harder
- Patch internet-facing systems first, especially VPNs, firewalls and backup servers, and prioritise vulnerabilities on CISA's Known Exploited Vulnerabilities catalogue.
- Require MFA on every remote access path, and use phishing-resistant MFA for administrators.
- Apply account lockout or smart lockout to slow password guessing.
Limit what an intruder can reach
- Restrict administrative tools and privileges to the people who need them, and separate admin accounts from everyday ones.
- Block unapproved remote access and remote execution tools with application control.
- Segment file servers, databases and backup infrastructure from user networks.
Make data theft visible
- Monitor for large or unusual outbound transfers, particularly from servers.
- Know where your sensitive data lives, so you can tell quickly what an attacker could have reached.
- Collect endpoint, identity and network telemetry centrally, for example in Microsoft Sentinel and Defender XDR, so the steps above can be correlated.
Protect recovery
- Keep at least one backup copy immutable or offline, with credentials that don't live in your main directory.
- Test restores regularly, including a full rebuild of a critical system.
Prepare for the extortion
- Have an incident response plan that covers data theft as well as encryption, including legal, regulatory and communications steps.
- Decide in advance who makes decisions about ransom demands and law enforcement contact. UK victims can report to the NCSC and to Report Fraud (in Scotland, Police Scotland on 101).
Frequently asked questions
What is the difference between ransomware and double extortion ransomware?
Traditional ransomware only encrypts data. Double extortion adds data theft before encryption and threatens to publish the stolen data if the victim doesn't pay.
Does paying the ransom stop the data being leaked?
There is no guarantee. Criminal groups have published or resold data after being paid. Government agencies advise against paying, and point out that payment doesn't guarantee recovery or deletion.
What is a leak site?
A website, usually on the Tor network, where a ransomware group lists its victims and publishes stolen data from those who refuse to pay.
What is triple extortion?
Triple extortion adds a third lever, such as contacting the victim's customers, phoning staff, or attacking the victim's website, to increase pressure to pay.
Can a managed SOC prevent double extortion?
No single control prevents every attack. 24/7 monitoring shortens the time between an intruder's first action and someone noticing, which is often the difference between a contained intrusion and a leak.
How Wizard Cyber can help
Our 24/7 SOC watches for the behaviour that comes before encryption: brute force that succeeds, new admin accounts, unfamiliar remote tools, data staging and large uploads. CYBERSHIELD AI investigates every incident, with an average time to verdict of 3 minutes 30 seconds, and senior analysts sign off by default on the managed service. If you are already dealing with an attack, our incident response team can help you scope what was taken and recover.
To talk through your exposure, get in touch or book a demo.