Double-Extorsion

Definition

Double extortion is a ransomware tactic where the attacker doesn’t just encrypt your files — they also **steal a copy of them first**.

In a “traditional” ransomware attack, the threat is simple: *Pay up, or you’ll never see your data again.* With double extortion, there’s a second threat layered on top: *Even if you restore your systems, we’ll leak your sensitive files online unless you pay.*

This ups the pressure because:

* You can’t just rely on backups — your data is already in the attacker’s hands.
* The stolen data might contain customer info, trade secrets, or embarrassing internal communications.
* The public release could trigger regulatory fines, lawsuits, and reputational damage.

Typical flow of a double extortion attack:

```
Step 1 – Gain Access
Step 2 – Steal Sensitive Data
Step 3 – Deploy Ransomware to Encrypt Files
Step 4 – Demand Payment for Decryption
Step 5 – Threaten to Leak or Sell Data if Payment Isn’t Made
```

From an investigation perspective, you’d look for signs of both **exfiltration** (large outbound data transfers, suspicious cloud uploads) and **encryption activity** (spikes in file modifications, ransomware notes). Many modern ransomware groups — like LockBit, BlackCat, and Conti — have dedicated leak sites where they publish victim data as “proof” and countdown to public release.

Got it — I’ll always include **further reading with real-world examples** going forward.

**Further Reading – Double Extortion**

* **CISA – Ransomware and Data Extortion**
  [https://www.cisa.gov/news-events/alerts/2021/09/22/ransomware-and-data-extortion](https://www.cisa.gov/news-events/alerts/2021/09/22/ransomware-and-data-extortion)
  U.S. government advisory explaining the trend, with mitigation strategies.

* **The Rise of Double Extortion Ransomware** – CrowdStrike
  [https://www.crowdstrike.com/cybersecurity-101/ransomware/double-extortion/](https://www.crowdstrike.com/cybersecurity-101/ransomware/double-extortion/)
  A clear breakdown of how double extortion works, attacker motivations, and defenses.

* **LockBit Ransomware Group Leak Site** – Krebs on Security
  [https://krebsonsecurity.com/2022/01/lockbit-ransomware-gang-publishes-victim-data/](https://krebsonsecurity.com/2022/01/lockbit-ransomware-gang-publishes-victim-data/)
  Real-world reporting on LockBit publishing stolen data when victims refused to pay.

* **CNA Financial Ransomware Attack** – BleepingComputer
  [https://www.bleepingcomputer.com/news/security/cna-financial-paid-40-million-ransom-to-revil-hackers/](https://www.bleepingcomputer.com/news/security/cna-financial-paid-40-million-ransom-to-revil-hackers/)
  Example of a major company paying ransom after attackers exfiltrated sensitive files before encryption.

* **BlackCat (ALPHV) Public Leak Sites** – The Record
  [https://therecord.media/blackcat-alphv-ransomware-group-victim-leak-site](https://therecord.media/blackcat-alphv-ransomware-group-victim-leak-site)
  Illustrates how modern ransomware gangs use dark web portals to pressure victims during double extortion attacks.

* **MITRE ATT\&CK – Exfiltration and Impact Techniques**
  [https://attack.mitre.org/tactics/TA0010/](https://attack.mitre.org/tactics/TA0010/)
  Technical mapping of exfiltration methods tied to ransomware double extortion campaigns.

Explore More Terms

Practice in These Games

Jojo's Hospital: A Ransomware Investigation

Jojo's Hospital, a cornerstone of Lexington's healthcare system, faces a critical crisis. The stakes are immense: will the hospital recover its vital services and secure patient data 🏥 or succumb t...

View Game