Loading story…
Cybercriminals are increasingly abandoning file encryption in favor of data-theft extortion, stealing sensitive information and demanding payment to prevent its publication. A Resilience report found that 65% of extortion-related claims in H2 2025 did not involve encryption, up from 49% in H1, while by year-end only 13% of attacks relied on encryption alone. Insurers and researchers said stronger backup and recovery practices have reduced the leverage of traditional ransomware, making data exfiltration a faster, lower-risk path to monetization for attackers.
Recent campaigns illustrate the shift. Silent Ransom (Luna Moth) has targeted law firms since 2023 and reportedly extracted multimillion-dollar payments from Goodwin Procter and WilmerHale, while BlackFile/Redact used high-volume vishing and SaaS data theft against real estate, healthcare, technology, finance, and legal organizations, with Google Threat Intelligence Group estimating it collected more than $10 million between February and mid-May. Researchers warned that paying for data suppression is unreliable—30-40% of policyholders that paid still saw data leaked, sold, or shared—and urged organizations to prioritize stopping exfiltration, protect cyber-insurance information, and rehearse extortion-response decisions through tabletop exercises.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
15 events from the most recent confirmed update back to the earliest known activity.
Google Threat Intelligence Group said that in July 2026 BlackFile concentrated on financial and legal targets, including private equity firms, law firms, and financial rating agencies.
Google Threat Intelligence Group said BlackFile changed focus in June 2026 to target large technology, transportation, and hospitality organizations.
Google estimated from Bitcoin transactions that BlackFile collected more than $10 million in ransom payments between February and mid-May 2026.
Google Threat Intelligence Group said BlackFile spent April and May 2026 targeting enterprises in the real estate, healthcare, and insurance sectors.
The newsletter says Reuters reported a series of attempted cyberattacks against Wall Street organizations that were linked to BlackFile, including major hedge funds and private equity firms.
The newsletter says the Cyber Risk Insurer reported that WilmerHale paid Silent Ransom an $18 million ransom in 2026.
The newsletter says the Cyber Risk Insurer reported that Goodwin Procter paid Silent Ransom a $10 million ransom in 2026.
The Risky Biz newsletter identifies BlackFile, later calling itself Redact, as a data-theft extortion group that emerged in early 2026.
Resilience said 65% of extortion-related claims it handled in H2 2025 did not involve data encryption, showing a marked increase from the first half of the year.
Resilience reported that 49% of extortion-related claims it handled in H1 2025 did not involve data encryption, indicating a growing shift toward data-theft-led extortion.
By the end of 2025, Resilience reported that only 13% of attacks relied on encryption alone, while data theft alone or combined with encryption accounted for 87% of ransomware claims.
A January report cited by Infosecurity said there were almost 1,500 extortion incidents in 2025 that relied on data theft alone.
The Infosecurity article cites a January report stating there were 28 extortion incidents relying on data theft alone in the prior year.
The newsletter cites the 2024 UnitedHealth ransomware incident as an example showing that encrypting ransomware still causes serious real-world disruption despite the rise of data-theft extortion.
The Risky Biz newsletter says Silent Ransom, also known as Luna Moth, has targeted law firms since 2023 as part of its data-theft extortion activity.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
news.risky.biz
Open sourcerisky.biz
Open sourceinfosecurity-magazine.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cyber insurance and threat reporting indicate **ransomware operators are increasingly leaning on data theft and extortion** as organizations improve backup and recovery. Coalition’s 2025 claims data (across 100,000+ policyholders) shows **business email compromise (BEC)** and **funds transfer fraud (FTF)** dominated claims volume, while **ransomware** represented a smaller share but featured **sharply higher initial demands** (average just over **$1.0M**, with some as high as **$16M**) even as average loss severity declined—consistent with improved restoration and response reducing the leverage of pure encryption-only attacks. In parallel, the broader ransomware ecosystem continues to **reorganize rather than shrink** despite sustained law-enforcement disruption of major RaaS brands (e.g., LockBit/Hive/ALPHV), with reporting citing high victim-post volumes across dozens of active operations. Halcyon reported a **tactical shift among pro-Iranian/pro-Palestinian-aligned operators** away from *Sicarii* toward **BQTLock (Baqiyat 313 Locker)**, including promotion of “free” RaaS access via Telegram and targeting focused on the UAE, US, and Israel. Separately, **ShinyHunters** claimed a major theft from AI merchant-data platform *Woflow* (alleging internal data, PII, and transaction/order details) but provided no sample for verification at the time of reporting, while a separate SC Media piece used the **SoundCloud** incident (reported exposure of data tied to ~**29.8M** accounts) to highlight incident-response and crisis-management considerations rather than new technical findings.
Jun 29, 2026
Ransomware operations are increasingly **industrialized**, shifting from simple file encryption to multi-stage extortion that combines **encryption**, **data theft/leak threats**, **DDoS**, and in some cases direct pressure on third parties such as customers, partners, or regulators. This “quadruple extortion” model has been associated with major groups including **ALPHV/BlackCat**, **CL0P**, and **LockBit**, reflecting a broader trend toward scalable, high-tempo campaigns designed to maximize coercion and revenue. At the same time, incident-response reporting indicates some **zero-day-driven, downstream mass data-theft extortion** campaigns—popularized by **CL0P** against widely used file-transfer platforms—are becoming less effective at driving payments, as organizations better understand that paying for “data suppression” does not remove notification obligations or meaningfully reduce litigation and re-extortion risk. Separately, GuidePoint assessed with high confidence that the new “**0APT**” leak site’s claimed victim list is largely **fabricated** (or recycled from other groups) and likely intended to enable opportunistic extortion, re-extortion, or affiliate fraud; organizations named by 0APT were advised to validate impact via concrete indicators (e.g., ransom note, encryption, direct communication) before treating the posting as evidence of compromise.
Jun 29, 2026
**Data-extortion intrusions increased sharply last year**, with Intel 471 tracking roughly **6,800 extortion-driven attacks**—about **63% higher than 2024**—and attributing much of the growth to heightened activity from **Qilin**, **Sp1d3r Hunters**, and **Clop** operations. More than half of impacted organizations were in the **United States**, with frequent targeting of **consumer and industrial product vendors, consulting firms, and manufacturing**; Intel 471 also assessed that **initial access brokers** increasingly focused on **remote access portals** as an entry point. The same analysis noted that attackers abused a significant portion of disclosed vulnerabilities (over **40% of 520** reported bugs) and forecast that **AI** will likely *accelerate* exploitation and enable higher-ROI fraud (e.g., deepfake impersonation), even if it is not yet the primary driver of intrusions. Broader threat reporting described a **fragmenting cybercrime economy** under law-enforcement pressure, with more **new ransomware variants** derived from leaked code and a more **modular “supply chain”** of specialized services (access, laundering, negotiation) that can rapidly reconstitute after disruptions. Separate reporting highlighted how **low-tech social engineering** remains effective—such as help-desk impersonation used to reset credentials and redirect payroll—and how healthcare continues to be a favored extortion target, including the emergence of a new **“Insomnia” data-theft** brand claiming mostly US healthcare-related victims. These trends reinforce that extortion risk is being driven not only by malware families, but by **repeatable access paths** (remote access exposure, credential reuse, and service-desk process weaknesses) that enable fast monetization.
Jun 29, 2026