What is double extortion ransomware?

Where it came from

To understand double extortion, it helps to understand the single-extortion model it replaced. Early ransomware had one lever: it encrypted your files and demanded payment for the key. The defense was correspondingly simple. An organization that kept good, isolated backups could wipe the infected systems, restore from a clean copy, and refuse to pay, taking the attacker's only source of leverage away. As more organizations improved their backups, ransom payment rates started to fall, and the criminals needed a new way to force payment.

They found it around 2019 and 2020, when groups such as Maze pioneered the tactic that is now standard practice. Instead of only encrypting, they began stealing a copy of the victim's data first, then using the threat of publishing it as a second, independent form of extortion. The term double extortion captures this exactly: the victim is squeezed twice over, once by the locked systems and again by the stolen data.

How double extortion works in practice

In a double-extortion attack, the exfiltration of data happens during the quiet weeks before encryption. Having gained access and explored the network, the attacker identifies the most sensitive and valuable data, patient records, financial information, intellectual property, and copies it out to infrastructure they control. Only after the theft is complete do they trigger the encryption and leave the ransom note.

The note now carries two threats. Pay, and you get the decryption key and a promise to delete the stolen data. Refuse, and not only do your systems stay locked, but the attacker publishes your data on a public leak site, often releasing it in stages to ratchet up the pressure, and may auction it to other criminals. Many groups run professional-looking leak sites with countdown timers precisely to make the threat feel inevitable.

Why it changed the defensive equation

Double extortion fundamentally altered what good backups can and cannot do for you. Backups remain essential, and they solve the first problem completely: with clean, immutable, air-gapped backups you can restore your systems and operations without the decryption key. But backups do nothing about the second problem. The data has already left your environment, and restoring your systems does not un-steal it. The leak threat survives even a flawless recovery.

This is why modern ransomware defense has had to expand its focus from recovery to also include stopping the theft itself. The large, abnormal outbound data transfers that signal exfiltration in progress are detectable, especially at the network level, and catching them is a chance to interrupt a breach before it completes. An organization that can spot data leaving in bulk and cut it off has a shot at preventing the double-extortion leverage from ever forming.

Triple extortion and further escalation

Some groups have pushed beyond two levers into what is often called triple extortion. This adds further pressure tactics on top of encryption and the leak threat: directly contacting the victim's patients, customers, or partners to tell them their data was stolen; threatening to report the breach to regulators; or launching distributed denial-of-service attacks to knock the victim's remaining systems offline during negotiations. The goal is always the same, to make not paying feel more painful and more public than paying.

What it means for healthcare

Double extortion is especially dangerous in healthcare because of the data involved. A hospital holds some of the most sensitive personal information that exists, protected health information, and the regulatory and human consequences of leaking it are severe. Under US guidance, a ransomware attack on protected health information is generally presumed to be a reportable breach, so the stolen-data dimension of a double-extortion attack is not just a reputational risk but a compliance and legal one.

The practical takeaway for any organization, and hospitals in particular, is that a complete defense has to address both halves of the attack. Immutable, air-gapped backups preserve your ability to recover and refuse the encryption ransom. Network-level detection of exfiltration gives you a chance to stop the data theft that creates the second, harder-to-answer threat. Neither alone is sufficient against an attacker who has learned to squeeze from two directions at once.

Should you ever pay in a double-extortion case?

Double extortion is designed to make paying feel like the only way to make the problem disappear, so it is worth being clear about why paying so often fails to deliver. When the leverage is stolen data, paying buys only a promise, the attacker's word that they will delete the data and not leak it. There is no way to verify that promise. Criminals have kept copies, leaked data anyway, come back for a second demand, or simply sold the information regardless of payment. Law enforcement agencies, including through CISA guidance, consistently discourage payment precisely because it funds the next wave of attacks and offers no guarantee of the outcome the victim is paying for.

This is why the realistic goal is to never be in that position in the first place, or to have made it survivable in advance. Stopping exfiltration before it completes means there is no stolen data to extort with. Immutable backups mean the encryption half holds no power. And for the data that might still be exposed, having a clear, practiced breach-response and notification process turns a chaotic negotiation into a managed obligation. The organizations best placed against double extortion are the ones that have decided, before any attack, that paying will not be their plan, and have built the detection, recovery, and response capabilities that make that stance credible.