There has been a sharp increase in data-only extortion incidents, with ransomware gangs increasingly opting not to encrypt files, instead simply breaching networks, exfiltrating sensitive data, and demanding a ransom payment to prevent the data from being leaked or sold.

Ransomware started to become popular with threat actors in the early to mid-2010s. Attacks involved breaching networks and using robust encryption to prevent data access. The emergence of untraceable cryptocurrencies helped fuel an explosion in ransomware attacks. In the mid-2010s, encryption alone proved to be sufficient, with the majority of victims opting to pay to recover their data. By 2020, double extortionbecame more prevalent, where data is stolen prior to file encryption. A ransom payment is required to obtain the decryption keys and prevent the publication or sale of stolen data. Double extortion fast became the norm, with the majority of ransomware attacks involving data theft and extortion.

The rapid rise in ransomware attacks forced organizations to address their data backup policies. While attacks may involve deletion or encryption of backups, victims are now much more likely to have offline backup copies of critical data that they can use to recover from the encryption with minimal data loss. It is often the threat of sale or leaking of exfiltrated data that is the primary reason for paying a ransom, as organizations seek to limit reputational damage.

Data encryption increases the chances of detection, attacks take longer, and fewer victims are paying ransoms to recover encrypted data. Threat actors understand that the reputational harm caused by data leaks is often enough, and some groups have abandoned encryption altogether. For example, PEAR (Pure Extortion and Ransom), a newly formed threat group that emerged in 2025, has exclusively adopted data-only extortion, as has the Silent Ransom group.

The recently published Arctic Wolf 2026 Threat Report confirms that ransomware attacks continue to be lucrative for threat actors. Ransomware attacks accounted for 44% ofArctic Wolf’s incident response (IR) cases from November 2024 to November 2025, exactly the same percentage as the previous reporting period. While there have been significant law enforcement operations targeting the most prolific ransomware groups – LockBit, ALPHV/BlackCat, and BlackSuit – those actions have had little effect on reducing the volume of attacks, and have simply shifted the ransomware ecosystem. There has been a proliferation of smaller groups, and some groups have stepped up attack volume to fill the vacuum.

Arctic Wolf’s report highlights the growing trend of data extortion-only attacks, which increased elevenfold between November 2024 and November 2025.  Data extortion-only attacks increased from 2% of Arctic Wolf’s IR cases in the previous reporting period to 22% in the current reporting period. “We’re seeing a clear pivot in attacker behavior. As organizations improve their ability to recover from encryption events, some threat actors are skipping ransomware altogether and moving straight to data theft and extortion,” said Kerri Shafer-Page, VP of Incident Response, Arctic Wolf. “From an incident response perspective, this shift fundamentally changes how impact is assessed and managed.”

Arctic Wolf said the increase in data extortion-only attacks shows that threat groups are willing and able to evolve when needed, and attributes the rise in attacks to organizations being better prepared and able to recover quickly from traditional encryption events. Arctic Wolf reports that ransomware actors are maturing their affiliate ecosystems and are now operating very much like business enterprises, with structured affiliate programs, tiered revenue models, and operational support to attract and retain a broader pool of cybercriminals.

Arctic Wolf also reports a prominent trend of diversification of ransomware-as-a-service (RaaS) offerings, where, in addition to a percentage of any ransom payments, affiliates are offered data extortion and access monetization, allowing them to profit from stolen data and compromised credentials without having to encrypt files with ransomware. For the time being, at least, Arctic Wolf has not observed any significant increase in activity from groups with these offerings. What has had an immediate impact is groups absorbing affiliates from other RaaS programs, such as Qilin, which recruited affiliates from the RansomHub operation when it shut down, and rapidly accelerated attacks and became the most prolific threat group.

Aside from ransomware, Business Email Compromise (BEC) continues to be favored by hackers, accounting for 26% of Arctic Wolf’s IR cases, although the targets were primarily finance and legal firms, rather than healthcare organizations. While phishing is the leading initial access vector for BEC attacks, other hacking incidents mostly involved attacks on remote access tools, remote monitoring and management software, and VPNs. These access vectors were used in around two-thirds of non-BEC IR cases, up from 24% three years ago. The exploitation of vulnerabilities has fallen from 26% of IR cases in the previous reporting period to just 11% in the current reporting period.

The post Data Shows Elevenfold Increase in Data-only Extortion Attacks appeared first on The HIPAA Journal.