Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Double extortion is a ransomware tactic that combines two threats: attackers encrypt systems or files to deny access, then steal data and threaten to publish it. A related data-only extortion attack skips encryption entirely. Criminals copy sensitive information and demand payment to keep it private.
The distinction matters during an incident. Backups can help restore encrypted systems, but they cannot undo a disclosure threat. An organization must investigate both the loss of availability and the possibility that confidential data left its environment.
As an Amazon Associate I earn from qualifying purchases.
Double extortion, ransomware and data-only extortion compared
“Extortion” describes pressure backed by a threatened harm. In conventional ransomware, that harm is primarily loss of access: files or systems are encrypted, and the attacker demands money for a decryption key. Data theft is not required.
Double extortion adds a second pressure. Before, during or after encryption, the attacker copies information and threatens to release it publicly. The victim is therefore pressured to pay for restoration and to reduce the chance of disclosure. The sequence and tools differ among incidents; encryption does not always happen after exfiltration, and some attacks include several rounds of theft.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Data-only extortion uses the disclosure threat without ransomware encryption. CISA’s joint #StopRansomware Guide states: “In some cases, malicious actors may exfiltrate data and threaten to release it as their sole form of extortion without employing ransomware.” In that case, systems may continue operating normally while the organization faces a confidentiality crisis.
| Scenario | Encryption | Data theft | Main pressure | Primary response concern |
|---|---|---|---|---|
| Conventional ransomware | Yes | Not necessarily | Loss of access | Containment and recovery |
| Double extortion | Yes | Yes | Loss of access plus threatened disclosure | Recovery, exfiltration investigation and breach assessment |
| Data-only extortion | No | Yes | Threatened disclosure | Determine what was accessed or taken and assess exposure and response duties |
The response concerns in the table are practical consequences of the two mechanisms. Encryption attacks availability; publication threats attack confidentiality. Those harms can overlap, but solving one does not solve the other.
How a double-extortion attack typically unfolds
The following sequence is a teaching model rather than a fixed playbook. Actors can skip steps, repeat them or perform them in a different order.
- Initial compromise: An attacker obtains an entry point and establishes access to accounts, devices or services.
- Discovery: The intruder maps systems and searches for high-value files, credentials, backups and data repositories.
- Collection: Valuable records are gathered or staged for transfer. The target may include customer information, employee records, financial data, intellectual property or internal communications.
- Exfiltration: Copies are transferred outside the organization. The volume, destination and method vary; legitimate administration and file-transfer tools can be abused.
- Encryption or disruption: The attacker encrypts some or all systems, or otherwise interferes with operations. A group may encrypt endpoints, servers, virtual machines or shared storage.
- Demand and pressure: A ransom note or direct message demands payment. The attacker may provide proof-of-life samples, set a deadline or threaten to post the stolen material on a leak site.
RansomHub is one documented example: a joint advisory from the FBI, CISA, MS-ISAC and the Department of Health and Human Services described affiliates using encryption and exfiltration, with threatened publication through a data-leak site. That advisory describes a particular group at the time of publication, not a universal pattern for every ransomware operation.
Rank #2
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
How data theft works when no files are encrypted
In a data-only extortion incident, criminals still need access and a way to copy information, but they do not have to make the victim’s files unreadable. They may obtain data from a compromised server, cloud account, database, file share, workstation or third-party service, then move it to infrastructure they control. The organization may notice little or no downtime.
The pressure comes from confidentiality
The attacker’s leverage is the possibility that private material will be released to the public, customers, competitors, regulators or other criminals. The threatened harm can include exposure of personal information, trade secrets, negotiations, credentials, medical records or legally protected communications. Reputational damage, customer notification costs, regulatory scrutiny and loss of business can make the threat consequential even when every production system remains available.
Access is not the same as confirmed theft
An attacker’s statement that data was stolen is an allegation, not a complete incident record. Conversely, the absence of a public sample does not prove that no data was taken. Investigators need evidence from authentication logs, endpoint telemetry, cloud audit records, network flows, storage access history and any staging locations. A specific incident may require forensic specialists to determine which accounts and files were accessed, copied or exposed.
Recommended Free Tools
Why backups help—and what they cannot do
Backups are essential against the availability part of ransomware. Multiple usable copies can let an organization rebuild systems without relying on an attacker’s decryption key. They do not retrieve information that has already left the environment, remove a copy held by an attacker or guarantee that a disclosure threat is false.
Rank #3
- No wall warts: Work freely with its bus-powered USB-C. No wall outlet required.
- Big on space: High-capacity storage to store all your files in one place.
- Reliable backup: Safeguard assignments, projects, or sensitive files with trusted performance.
- Fuss-free, clutter-free: One port, one cord, quick connect.
- Peace-of-mind: Comes with two-year limited warranty and Rescue Data Recovery Services.
CISA and its partners recommend keeping multiple copies in a physically separate, segmented and secure location. A hard drive, other storage device or cloud repository can be one component of that design, but a single external hard drive is not a complete backup strategy. An external hard drive for offline backups should be disconnected or otherwise protected from routine network compromise, encrypted when appropriate and included in restore testing.
A resilient backup checklist
- Keep more than one copy and use more than one type of storage where practical.
- Maintain at least one copy that is physically separate or logically isolated from production credentials and networks.
- Restrict who can delete, alter or encrypt backup data; use separate administrative identities and multifactor authentication.
- Monitor backup jobs and alert on unusual deletions, permission changes or sudden increases in data change.
- Test restoration of individual files and complete systems, recording how long each recovery takes.
- Assume that backups restore availability, not confidentiality; pair them with access monitoring and data-loss controls.
What to investigate when extortion is suspected
CISA recommends developing an initial understanding of events, preserving relevant evidence and threat hunting for signs that information left the network. Investigators should examine both the encryption symptoms and the possibility of exfiltration.
Indicators that deserve immediate review
- Unusual outbound data volumes, especially from servers or accounts that rarely transfer large files.
- Unexpected connections to unfamiliar destinations, storage services or remote administration infrastructure.
- New or anomalous transfer utilities, compression programs, scripts or command-line activity.
- Unrecognized scheduled tasks, services, accounts, access keys or persistence mechanisms.
- Large archives created shortly before an incident, unusual staging directories or mass reads from sensitive shares.
- Cloud audit events showing abnormal downloads, token use, permission changes or access from unfamiliar locations.
- Ransom notes, direct messages, leak-site claims or small samples offered as alleged proof.
None of these signs is conclusive by itself. File-transfer and administration tools often have legitimate uses. Analysts should compare activity with known business processes, normal baselines, approved change records and the account owner’s explanation.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesPreserve evidence before it disappears
Isolate affected systems in a way that does not destroy volatile evidence, and coordinate with the incident-response team before wiping or rebuilding machines. Preserve relevant logs, memory captures where appropriate, ransom notes, email headers, cloud records, firewall data and copies of suspicious files. Record times in a consistent time zone and document who collected each item. Evidence preservation supports containment, scope determination, insurance and legal decisions.
Rank #4
- High-capacity external hard drive with up to 2TB of storage The ModusTech Facet portable external hard drive gives you dependable HDD storage in a slim 2.5-inch design. Multiple capacities available up to 2TB — back up photos, videos, music, documents, and game libraries with room to grow. A trusted external storage solution for everyday backup, media archives, and creative work.
- USB-C and USB 3.1 connectivity with included 2-in-1 cable The Facet ships with a USB-C to USB-C cable and tethered USB-A adapter, so this external hard drive connects to modern laptops, USB-C iPhones, tablets, and older USB-A computers without buying an extra cable. USB 3.1 Gen 1 (5Gbps) interface delivers real-world transfer speeds up to 100MB/s — fast enough to back up 50GB of files in about 8 minutes.
- Plug-and-play external hard drive for PC, Mac, and laptops Preformatted in exFAT and ready to use the moment you plug it in. The Facet works out of the box with Windows PCs, macOS Macs, MacBooks, Chromebooks, and laptops — no drivers, no software, no setup required. A true plug-and-play external hard drive built for everyday use across every major operating system.
- External hard drive for PS4, Xbox One, and Smart TV gaming The Facet is compatible with PlayStation 4, Xbox One, and Smart TVs with USB support. PS4 and Xbox One games run directly from the drive — plug it in, format through the console, and add to your storage. Also works with Smart TVs that support USB recording or external media playback.
- Slim, shock-resistant portable external hard drive — 160g At 2.5 inches and just 160g, this portable external hard drive is bus-powered through a single USB-C cable — no separate power adapter, no extra cables. Slim enough for a laptop bag, jacket pocket, or camera bag, with a shockresistant casing and faceted diamond-texture top panel that resists fingerprints and everyday wear. Backed by a 1-year limited warranty from ModusTech, a consumer electronics brand specializing in external storage.
Response steps for a suspected data-extortion incident
- Activate the incident plan: Assign technical, executive, communications, privacy and legal roles. Use out-of-band communications if corporate email or identity systems may be compromised.
- Contain the intrusion: Disable or limit compromised accounts, revoke exposed tokens and keys, isolate affected hosts and block confirmed malicious infrastructure. Avoid broad destructive actions until evidence needs are understood.
- Determine the two types of harm: Establish which systems are unavailable or encrypted, and separately identify what information may have been accessed, staged or transferred.
- Hunt for exfiltration: Review outbound traffic, endpoint and cloud logs, archive creation, unusual services and scheduled tasks. Trace the relevant accounts and destinations.
- Preserve and analyze evidence: Retain logs and forensic images, and bring in qualified responders when internal visibility is incomplete.
- Recover safely: Eradicate persistence, reset credentials, close the initial access path and restore from clean, tested backups. Recovery is not complete until monitoring confirms that the attacker no longer has access.
- Assess notification duties: If personal or regulated information was involved, follow the notification requirements that apply to the organization’s jurisdictions and sectors. The correct deadlines and recipients depend on the facts and local law.
- Coordinate communications: Use the incident communications plan for employees, customers, partners, regulators and law enforcement. State what is verified, what remains under investigation and what protective actions people should take.
The FBI’s public ransomware guidance says it does not support paying a ransom and recommends regularly backing up data and checking that backups completed. That is the FBI’s position; an organization’s decision must still account for the specific facts, legal advice, safety concerns, sanctions rules and the likelihood that payment will not prevent publication.
How to interpret leak-site claims
A leak-site listing can be an important lead, but it is not a complete incident database. CISA’s LockBit advisory notes that leak sites show only part of the victims subjected to secondary extortion and are not a reliable indicator of when attacks occurred. A victim may never appear publicly, and a listing may not establish exactly what was taken or when.
Treat posted files, screenshots and samples as evidence to validate, not as a substitute for internal investigation. Compare any sample with real records, determine whether it is current, identify the responsible system and preserve the page and downloaded material for forensic and legal review. Avoid assuming that a threat is harmless because no sample was posted, or authentic because a small sample appears.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Prevention priorities beyond backups
- Reduce unnecessary access: Apply least privilege, separate administrative accounts and promptly remove dormant users and keys.
- Protect identities: Use multifactor authentication, strong credential management and monitoring for impossible travel, token misuse and unusual privilege changes.
- Segment sensitive data: Keep critical repositories and backup systems separated from ordinary user networks, and limit east-west movement.
- Watch outbound movement: Establish normal transfer baselines and alert on unusual volumes, destinations, compression and encryption of outbound archives.
- Know where sensitive data resides: Maintain inventories and retention rules so investigators can quickly determine what a compromised account could reach.
- Exercise the plan: Run tabletop and technical recovery exercises that include a data-breach scenario, not only a restore-from-backup scenario.
No single control prevents every extortion attempt. The practical goal is to make unauthorized access harder, detect copying earlier, preserve reliable evidence and maintain recovery options while treating confidentiality and availability as separate risks.
What the two terms mean in one sentence
Double extortion is encryption plus stolen data and a publication threat; data-only extortion is stolen data and a publication threat without encryption. In both cases, the organization must investigate whether information left its control, even if systems can be restored or never went offline.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
