Ransomware headlines increasingly describe falling payment rates and smaller median ransoms, which can look like progress.
Underneath those numbers, a growing share of incidents never involve an encryptor at all: attackers steal data and threaten to publish it.
This article explains how data extortion ransomware works, what recent figures from Verizon, Coveware and CISA show, why file-transfer platforms and managed service providers are favoured targets, and how to detect and respond to exfiltration-only attacks.
From double extortion to data-only extortion
Classic ransomware encrypted files and demanded payment for a decryptor. Double extortion added data theft before encryption, so victims with good backups still faced a leak threat.
Encryptionless ransomware drops the encryption step entirely and keeps only the theft and the threat.
The shift is documented in government advisories. The joint CISA, FBI and ACSC advisory on BianLian (AA23-136A, updated November 2024) states the FBI observed the group move primarily to exfiltration-based extortion around January 2023, and ACSC saw an exclusive shift around January 2024 (CISA/FBI/ACSC, 2024).
The same advisory lists exfiltration via FTP, Rclone and Mega.
Why attackers are dropping encryption
- Speed and stealth: encryption is noisy. Mass file renames and shadow-copy deletion trigger EDR. Quiet bulk downloads often do not.
- Better backups: immutable backups weaken the decryptor as a bargaining tool, so the stolen data becomes the main bargaining chip.
- Less engineering: no need to maintain encryptors for Windows, Linux and ESXi.
- Lower law-enforcement heat: attacks that do not take hospitals or utilities offline attract less operational attention, though they remain serious crimes.
What the data says about data extortion ransomware
Several independent datasets point in the same direction: more incidents, lower payment rates, and extortion based on stolen data becoming routine.
| Finding | Source (year) |
|---|---|
| Ransomware present in 44% of breaches, up from 32% | Verizon DBIR executive summary (2025) |
| Median ransom paid fell to $115,000 from $150,000; 64% of victims did not pay | Verizon DBIR (2025) |
| Only 23% of victims paid in Q3 2025; just 19% in data exfiltration-only cases | Coveware data via Security Affairs (2025) |
| Third-party involvement in breaches doubled to 30% | Verizon DBIR (2025) |
Lower payment rates are good news, but they also push groups towards volume. When fewer victims pay, attackers compensate by hitting more organisations at once through shared software or service providers.
The Verizon figure on third-party involvement is the clearest sign of that trend. Our 2025 ransomware recap covers the major incidents behind these numbers.
Not every group has abandoned encryption, and some reporting suggests a partial swing back where data-only extortion pays poorly. Treat encryptionless attacks as an additional playbook rather than a full replacement.
Why lower payment rates do not mean lower risk
A falling payment rate measures attacker revenue, not victim harm. An organisation that refuses to pay still faces breach notification, regulatory scrutiny, litigation and the publication of sensitive data.
For security leaders, the more useful metric is how many incidents involved confirmed data loss, and how quickly that loss was detected.
Mass exploitation of file-transfer and business platforms
The most efficient data extortion campaigns exploit one vulnerability in widely used software, steal data from hundreds of organisations, and send extortion emails in bulk. No lateral movement or encryption is needed.
Examples of the pattern
- MOVEit Transfer (2023): the Cl0p group exploited a zero-day in Progress MOVEit and stole data from hundreds of organisations without deploying ransomware.
- Oracle E-Business Suite (2025): CVE-2025-61882 (CVSS 9.8) was exploited from at least August 2025, and extortion emails claiming EBS data theft began on 29 September 2025, according to Google, Mandiant and CrowdStrike findings (2025). Attribution to Cl0p/FIN11 varied by vendor.
- Social engineering at scale: leaked chat logs attributed to the Silent Ransom Group suggest it extorted law firms without encrypting data; those figures are unverified.
In ATT&CK terms these campaigns lean on T1190 (Exploit Public-Facing Application), T1567.002 (Exfiltration to Cloud Storage) and T1657 (Financial Theft), rather than T1486 (Data Encrypted for Impact).
Why MSPs and shared tooling amplify the damage
Managed service providers hold privileged remote access to many customers. Compromising one RMM platform gives an attacker a path into every downstream client. The 2021 Kaseya VSA incident showed this with REvil ransomware pushed through MSP tooling.
The same route works for data theft. In 2025, CISA advisory AA25-163A warned that ransomware actors were exploiting unpatched SimpleHelp RMM (CVE-2024-57727) to reach a utility billing software provider and its customers. An RMM agent already has file access, so pulling data out requires no extra tools.
Questions to ask your MSP
- Is RMM access protected by phishing-resistant MFA and restricted to named technicians?
- How fast are RMM and remote-access servers patched after a critical advisory?
- Can we receive RMM session logs and file-transfer events in our SIEM?
- Will you notify us within 24 hours of any compromise affecting our tenant?
Detecting exfiltration before the extortion email
Without encryption, the first sign of an attack is often the ransom note in a CEO’s inbox. Detection has to move earlier, to staging and transfer of data.
Practitioner example: detection logic for bulk cloud exfiltration
The following illustrative hunting logic, written as pseudo-KQL, flags Rclone and similar tools and unusual outbound volume from servers:
// Process indicators: sync tools on servers
DeviceProcessEvents
| where FileName in~ (“rclone.exe”,”rclone”,”megacmd.exe”,”winscp.com”,”restic.exe”)
or ProcessCommandLine has_any (“copy remote:”, “sync “, “–transfers”, “mega:”)
| where DeviceName in (ServerList)
// Volume indicator: outbound bytes far above baseline
NetworkFlows
| summarize out_bytes = sum(BytesSent) by SrcHost, DstDomain, bin(Timestamp, 1h)
| join kind=inner (Baseline_30d) on SrcHost
| where out_bytes > 10 * p95_hourly_out
| where DstDomain !in (ApprovedBackupDestinations)
Tune the thresholds to your environment. The aim is to alert on a file server sending tens of gigabytes to a new cloud storage domain at 03:00, which is exactly the behaviour BianLian-style actors exhibit.
Rclone deserves special attention because it is a legitimate administration tool, so simple hash blocking is not enough.
Look for it running from unusual folders such as ProgramData or user Music directories, for config files containing cloud storage credentials, and for command lines with high –transfers values.
A short allow-list of hosts permitted to run sync tools makes the remaining alerts far easier to triage.
For layered endpoint controls, see our guide to stopping endpoint data exfiltration.
Telemetry worth collecting
- Egress flow logs with byte counts per host and destination, retained for at least 90 days.
- Audit logs from file-transfer appliances, SaaS platforms and ERP systems, including bulk export events.
- DNS logs to spot first-seen cloud storage domains.
- RMM and remote-access session logs from MSPs.
If you are choosing tooling, compare commercial and open source observability tools on how well they retain and query high-volume network and application logs, since exfiltration hunting depends on that history.
Responding to a data-only extortion demand
Incident response changes when nothing is encrypted. There is no outage forcing a decision, but legal and notification clocks may already be running.
- Validate the claim: request a file listing or sample. Some extortion emails are bluffs or reuse old leaked data.
- Scope from logs: use egress, application and audit logs to establish what left, when and from where. Classify the affected data (personal, financial, health, intellectual property) because that classification drives notification duties.
- Contain the access path: patch the exploited system, rotate credentials and revoke sessions and API tokens.
- Engage counsel early: data protection laws, SEC disclosure rules and contracts may set deadlines independent of the extortion.
- Decide on payment with eyes open: paying cannot guarantee deletion. Check sanctions exposure and law-enforcement guidance before any decision.
Policy around AI and cyber operations is also moving quickly; reporting on government handling of advanced AI models suggests defenders’ actions may soon be shaped by new rules. Keep legal and policy teams in the loop when you update response playbooks.
Hardening priorities mapped to frameworks
| Control | Why it matters for data extortion | Framework reference |
|---|---|---|
| Rapid patching of internet-facing file-transfer, ERP and RMM systems | Removes the mass-exploitation entry point | CIS Controls v8 Control 7; NIST CSF 2.0 ID.RA |
| Egress filtering and allow-listing of cloud storage destinations | Blocks Rclone/Mega exfiltration from servers | CIS Control 13; NIST CSF 2.0 PR.IR |
| Data minimisation and retention limits | Less stored data means less to steal | CIS Control 3; NIST CSF 2.0 PR.DS |
| Phishing-resistant MFA on remote access and MSP accounts | Stops credential-based access | CIS Control 6; NIST CSF 2.0 PR.AA |
| Third-party access review and MSP log sharing | Addresses supply-chain routes | CIS Control 15; NIST CSF 2.0 GV.SC |
Key takeaways
- Data extortion ransomware skips encryption, so the first sign of attack is often the extortion demand itself.
- Payment rates are falling, with Coveware reporting 19% for exfiltration-only cases in Q3 2025, which pushes attackers towards mass exploitation.
- File-transfer platforms, ERP systems and MSP remote tools are high-value targets because one flaw exposes many victims.
- Detection must focus on staging and egress: sync tools on servers, unusual outbound volume and first-seen storage domains.
- Response priorities shift to scoping data loss and meeting legal notification deadlines.
FAQ
What is data extortion ransomware?
It is an attack where criminals steal data and demand payment to avoid publishing or selling it, without encrypting the victim’s systems. It is sometimes called encryptionless ransomware.
Is double extortion the same as data extortion?
No. Double extortion combines encryption with a data-leak threat. Data-only extortion uses the leak threat alone, which makes it quieter and faster to execute.
Do backups protect against data extortion?
Backups restore availability but do nothing about stolen data being published. Protection depends on preventing access, detecting exfiltration and minimising the data you hold.
Should you pay a data extortion ransom?
Payment cannot guarantee deletion, and paying may raise sanctions or legal issues. Most guidance, including from law enforcement, discourages payment; any decision should involve counsel and incident responders.
How do attackers exfiltrate data in ransomware attacks?
Common methods include Rclone or MEGA clients sending data to cloud storage, FTP, and abuse of legitimate file-transfer or RMM tools already present in the environment.
