Free tools Windows power users keep installed
One-click scans. No signup required.
A data-breach extortion group steals an organization’s information and threatens to expose, sell or auction it unless the organization pays. Some groups also encrypt systems, combining data theft with disruption in what security agencies call double extortion. Others threaten disclosure without encrypting files. Their methods vary, but the pattern is often unauthorized access, internal exploration, data theft and pressure on the victim.
How is data-breach extortion different from ransomware?
In data-theft-only extortion, the leverage is the threat to disclose stolen information. The victim may still be able to use its systems, but restoring them does not resolve the risk that the data will be published or sold. CISA describes data-release threats as a possible standalone extortion method in its #StopRansomware Guide.
As an Amazon Associate I earn from qualifying purchases.
Double extortion adds encryption to that disclosure threat. The attackers can demand payment both to address operational disruption and to prevent the release of data. Backups can help an organization restore systems, but they cannot undo an attacker’s copy of stolen information. CISA, the FBI and HHS describe this model in their August 18, 2026 Medusa advisory update.
| Operating model | Encryption | Data theft | Main leverage |
|---|---|---|---|
| Data-theft-only extortion | Not required. The 2022 Karakurt advisory said no victim reports of encryption had been reported in the activity it described. | Yes, according to actor claims and victim evidence described in the advisory. | Threat to disclose, sell or auction information. |
| Double extortion | Yes, alongside data theft in the cited CISA definition and Medusa example. | Yes. | Operational disruption plus a disclosure threat. |
These are operating models, not labels that guarantee what a particular group will do. The FBI, CISA, Treasury and FinCEN Karakurt advisory described victims with no reported encryption, while the Medusa update describes encryption and threatened publication.
#1 Best Overall
How does an extortion operation unfold?
There is no single entry method, fixed sequence or universal toolset. Official advisories describe several recurring stages, but group-specific examples should not be treated as a checklist for every incident.
1. Obtain access
Access may come from stolen or purchased credentials, phishing, exploitation of vulnerable internet-facing systems, or another criminal who already has access. The 2026 Medusa update describes brokered access, phishing and exploitation of unpatched internet-facing vulnerabilities. The 2022 Karakurt advisory also describes cooperating criminal partners, intrusion brokers, vulnerable VPN or firewall appliances and exposed software vulnerabilities.
2. Explore the organization and take data
After gaining access, attackers may look for systems, accounts and files of value, seek additional credentials, and move through the network. The Karakurt advisory documents network enumeration, credential access, lateral movement and data exfiltration, including the use of file-transfer and cloud-storage services. The Medusa update describes legitimate and common tools used in activity involving credential access, data exfiltration and ransomware deployment. Those details describe reported cases; they do not establish a standard sequence for all groups.
3. Make the threat credible
Groups may name a victim on a leak site, show samples of allegedly stolen information, or threaten to disclose, sell or auction it. In double extortion, encryption adds pressure by interrupting operations. A sample can support a threat’s credibility, but it does not by itself establish how much data was taken or whether every actor claim is accurate.
4. Demand payment and apply pressure
Victims may receive a ransom note with a deadline and a controlled channel for negotiation. The Karakurt advisory describes threats of release or auction and contact with employees, clients and business partners, extending pressure beyond the organization’s negotiators. It also warns that actors may exaggerate what they stole and that a payment does not assure deletion or continued confidentiality of the information.
What does the Medusa example show?
The Medusa example illustrates one group’s reported model, not the prevalence or behavior of extortion groups as a whole. In its August 18, 2026 update, CISA, the FBI and HHS said Medusa was first identified in June 2021 and that, as of April 2026, Medusa actors had impacted more than 500 victims across multiple critical-infrastructure sectors. The figure is specific to Medusa and the date and scope stated by those agencies. The update describes brokered access, phishing, exploitation of unpatched internet-facing vulnerabilities, use of legitimate tools, and a double-extortion model.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What can organizations do to reduce risk?
Official guidance focuses on making initial access harder, limiting how far an intruder can move, and preserving recovery options. These steps reduce risk; they do not guarantee prevention or replace an incident-response plan.
- Patch exploited and exposed systems: Prioritize known vulnerabilities on internet-facing services using a risk-informed timeframe, as recommended in the Medusa update and the Karakurt advisory.
- Restrict remote access: Filter access from unknown or untrusted origins to internal remote services, and use multifactor authentication. The Karakurt advisory also recommends user awareness of phishing.
- Segment networks: Separate systems and access so a compromised account or device has fewer paths to other parts of the organization.
- Protect backups: Keep multiple protected backup copies, including offline copies, as advised in the Karakurt advisory. Backups support recovery from disruption; they do not remove the disclosure risk if information was copied.
If an incident is underway, consult current official advisories and applicable local reporting requirements. Indicators and group-specific contact details can become stale; CISA’s ransomware guide provides prevention and response guidance developed with MS-ISAC, the NSA and the FBI.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
