Data-Theft Extortion Overtakes Encryption in Ransomware Campaigns

Cybercriminals are increasingly abandoning file encryption in favor of data-theft extortion, stealing sensitive information and demanding payment to prevent its publication. A Resilience report found that 65% of extortion-related claims in H2 2025 did not involve encryption, up from 49% in H1, while by year-end only 13% of attacks relied on encryption alone. Insurers and researchers said stronger backup and recovery practices have reduced the leverage of traditional ransomware, making data exfiltration a faster, lower-risk path to monetization for attackers.

Recent campaigns illustrate the shift. Silent Ransom (Luna Moth) has targeted law firms since 2023 and reportedly extracted multimillion-dollar payments from Goodwin Procter and WilmerHale, while BlackFile/Redact used high-volume vishing and SaaS data theft against real estate, healthcare, technology, finance, and legal organizations, with Google Threat Intelligence Group estimating it collected more than $10 million between February and mid-May. Researchers warned that paying for data suppression is unreliable—30-40% of policyholders that paid still saw data leaked, sold, or shared—and urged organizations to prioritize stopping exfiltration, protect cyber-insurance information, and rehearse extortion-response decisions through tabletop exercises.