Data extortion has rapidly become one of the most common forms of cybercrime, replacing traditional ransomware as the preferred business model for many threat actors. Instead of encrypting files and demanding payment to restore access, attackers increasingly steal sensitive information and threaten to publish or sell it unless a ransom is paid.
The strategy has proven highly effective. While organizations can often recover encrypted systems from backups, there is no backup for data that has already been copied outside the network. Once customer records, employee information, financial documents, source code, or intellectual property have been stolen, organizations face legal obligations, regulatory scrutiny, reputational damage, and the possibility of sensitive information becoming permanently public.
BreachNews has tracked hundreds of alleged breach and extortion claims affecting organizations across healthcare, education, retail, financial services, government, manufacturing, technology, telecommunications, and critical infrastructure. Although every incident is different, most modern data extortion campaigns follow the same basic playbook.
This guide explains how data extortion works, why it has become so widespread, what attackers are typically looking for, and the practical steps organizations and individuals can take to reduce their risk.
What Is Data Extortion?
Data extortion is a cybercrime in which attackers steal sensitive information from an organization and demand payment to prevent it from being published, sold, or shared.
Unlike traditional ransomware, attackers do not necessarily need to encrypt systems. Their leverage comes from possessing confidential information that could harm the victim if disclosed publicly.
Many extortion groups operate public leak sites where victims are listed alongside countdown timers, descriptions of allegedly stolen data, screenshots, or sample files. If negotiations fail, attackers often claim to release the data publicly or offer it for sale.
Groups including ShinyHunters, FulcrumSec, TeamPCP, World Leaks, and numerous others have relied on this model during campaigns tracked by BreachNews.
How Data Extortion Works
While no two intrusions are identical, most campaigns follow a predictable sequence.
1. Initial access
Attackers first need a way into the victim’s environment. Common entry points include:
- Phishing emails
- Stolen usernames and passwords
- Infostealer malware
- Exploited vulnerabilities
- Cloud misconfigurations
- Compromised third-party software
- Remote access services such as VPNs or RDP
Many recent attacks have begun with compromised credentials harvested by infostealer malware. If you’re unfamiliar with how those campaigns work, see our guide explaining what infostealer malware is and how it steals credentials.
2. Expanding access
Once inside a network, attackers typically attempt to elevate their privileges and move laterally across systems. Their objective is to identify the locations where valuable information is stored.
This may include file servers, cloud storage, Microsoft 365 environments, Salesforce instances, GitHub repositories, HR systems, backup servers, email platforms, and internal documentation portals.
3. Data discovery and theft
After identifying valuable information, attackers collect and stage files before transferring them outside the organization’s environment.
Rather than stealing everything, they usually focus on information that creates leverage during negotiations.
Common targets include:
- Customer databases
- Employee records
- Payroll information
- Healthcare records
- Financial documents
- Source code
- Cloud credentials
- Authentication tokens
- Contracts and legal documents
- Internal emails
- Salesforce exports
- Engineering documentation
Recent BreachNews reporting has documented campaigns involving alleged theft of Salesforce environments, GitHub repositories, cloud credentials, internal documentation, healthcare data, and customer databases across numerous industries.
4. The extortion demand
After data has been exfiltrated, attackers contact the victim with a ransom demand.
The organization is typically given a deadline to begin negotiations before the attackers threaten to publish or sell the allegedly stolen information.
Many groups maintain public leak sites where organizations are listed alongside countdown timers, proof-of-access screenshots, or descriptions of the stolen data.
For example, BreachNews has extensively tracked ShinyHunters, whose campaigns often progress from initial victim listings to alleged public releases after negotiations expire.
Coverage of those campaigns includes reports involving:
Why Data Extortion Is Replacing Traditional Ransomware
Over the past several years, many cybercriminal groups have shifted away from encryption-only attacks in favor of pure data theft and extortion.
The reason is simple: stealing data often creates just as much pressure while requiring less time inside a victim’s environment.
Even organizations with excellent backup strategies cannot restore data that has already been copied by attackers.
Public disclosure may trigger regulatory investigations, lawsuits, contractual obligations, customer notifications, and long-term reputational damage.
Several additional factors have accelerated the growth of data extortion:
- Cloud platforms centralize enormous amounts of sensitive information.
- Credential theft has become increasingly common through infostealer malware.
- Supply chain compromises allow attackers to reach multiple organizations simultaneously.
- Public leak sites amplify pressure during negotiations.
- Stolen data can continue generating revenue long after an intrusion ends.
Supply chain attacks have become particularly valuable because compromising one trusted vendor can provide access to dozens of downstream organizations.
BreachNews has reported extensively on this trend, including the Klue supply chain breach and TeamPCP’s software supply chain activity targeting developer ecosystems.
What Happens If a Company Doesn’t Pay?
Every extortion campaign unfolds differently, but organizations that decline to negotiate or fail to reach an agreement may face escalating pressure.
Threat actors commonly respond by publishing samples of allegedly stolen data, extending public countdown timers, or moving victims from a negotiation section of their leak site into a public release section.
Some groups also claim to distribute data through mirrors, torrents, or additional file hosting platforms to increase visibility and pressure.
Not every threat actor follows through on these claims, and not every published dataset is authentic. However, numerous campaigns tracked by BreachNews have progressed from extortion demands to alleged public data releases after deadlines expired.
Does Paying a Ransom Prevent the Data From Being Released?
Not necessarily.
Paying a ransom does not guarantee that stolen information will be deleted, nor does it guarantee that attackers will never publish or sell the data in the future. Cybercriminals operate outside the law, and victims have no reliable way to verify whether copies of stolen files have actually been destroyed.
Some organizations choose to negotiate in an attempt to reduce operational disruption or prevent publication, while others refuse to pay altogether. Every incident involves different legal, regulatory, financial, and operational considerations.
Even when a threat actor claims data has been deleted after payment, organizations should assume that any information removed from their environment could still exist elsewhere.
How Organizations Can Reduce Their Risk
No security program can eliminate risk entirely, but organizations can significantly reduce the likelihood and impact of a successful data extortion attack by combining strong technical controls with effective security processes.
Strengthen identity security
Compromised credentials remain one of the most common ways attackers gain initial access.
- Enable multi-factor authentication across all critical systems.
- Enforce strong password policies.
- Use a password manager instead of browser password storage.
- Monitor for impossible travel and unusual login activity.
- Disable inactive accounts promptly.
Reduce the attack surface
Limiting exposure makes it more difficult for attackers to establish a foothold.
- Patch internet-facing systems quickly.
- Remove unnecessary remote access services.
- Continuously monitor cloud storage for accidental public exposure.
- Review third-party vendors and software supply chain risks.
- Limit administrator privileges using the principle of least privilege.
Detect suspicious activity early
The earlier an intrusion is detected, the greater the chance of preventing large-scale data theft.
- Deploy endpoint detection and response (EDR).
- Monitor large outbound data transfers.
- Review authentication logs regularly.
- Alert on unusual cloud activity.
- Monitor privileged account usage.
Prepare before an incident occurs
Preparation often determines whether an organization experiences a manageable security incident or a full-scale crisis.
- Maintain tested offline or immutable backups.
- Create and regularly exercise an incident response plan.
- Develop executive communications procedures.
- Know regulatory notification requirements.
- Conduct periodic tabletop exercises.
Organizations should also train employees to recognize phishing attempts and other forms of social engineering, which continue to be among the most common initial access techniques.
For additional defensive guidance, see our guide on how organizations can prevent ransomware attacks.
What Individuals Should Do After a Data Breach
Although companies are typically the direct victims of data extortion campaigns, customers and employees are often the people most affected when personal information is stolen.
If an organization notifies you that your information may have been exposed, taking action quickly can reduce the risk of identity theft and account compromise.
Recommended steps include:
- Change passwords for affected accounts immediately.
- Enable multi-factor authentication wherever possible.
- Review financial accounts for unauthorized activity.
- Be cautious of phishing emails or phone calls referencing the breach.
- Monitor your credit for suspicious activity.
- Freeze your credit if sensitive identity information was exposed.
- Review active login sessions and remove devices you don’t recognize.
Helpful resources:
- How to Respond When You Receive a Data Breach Notification
- How to Freeze Your Credit After a Data Breach
- What Is Infostealer Malware?
- How to Recognize and Defend Against Social Engineering in the Workplace
Frequently Asked Questions
Is data extortion the same as ransomware?
No. Traditional ransomware encrypts systems to prevent access, while data extortion focuses on stealing sensitive information and threatening to publish it. Some threat actors combine both approaches in what is known as a double extortion attack.
How do attackers usually steal data?
Common entry points include phishing campaigns, stolen credentials, infostealer malware, exploited vulnerabilities, cloud misconfigurations, compromised third-party software, and exposed remote access services.
Can organizations recover without paying?
Yes. Many organizations successfully restore their operations without paying a ransom. However, recovery does not prevent attackers from claiming to possess stolen information or threatening to publish it.
Can stolen data be removed from the internet?
Once information has been copied and distributed online, complete removal is often impossible. Organizations should assume that publicly released data may continue circulating indefinitely.
Are all leak site claims legitimate?
No. Threat actor claims should always be treated cautiously until independently verified. Some groups publish authentic stolen data, while others exaggerate, recycle older datasets, or make unsupported claims. BreachNews reports alleged breaches using appropriate attribution unless organizations confirm an incident or independent evidence becomes available.
Final Thoughts
Data extortion has fundamentally changed the cybercrime landscape. For many threat actors, stealing sensitive information has become more profitable than encrypting systems, allowing them to pressure victims through the threat of public exposure rather than operational disruption alone.
For defenders, this means cybersecurity can no longer focus solely on keeping systems online. Organizations must also protect the confidentiality of their data through strong identity security, cloud security, continuous monitoring, employee awareness, and well-tested incident response plans.
As BreachNews continues tracking active extortion campaigns, one trend has become increasingly clear: public leak sites, stolen data, and extortion demands are no longer isolated events. They have become a defining feature of modern cybercrime.
To learn more about the groups behind these campaigns, visit the Threat Actors section, or explore BreachNews’ ongoing coverage of data breaches, ransomware, and cyberattacks.
