For years, one of the most important recommendations for defending against ransomware has been to maintain reliable backups. If attackers encrypt an organisation’s systems, restoring data from a secure backup can help avoid paying a ransom and reduce disruption.
However, cyber-criminals have developed other ways to pressure their victims. Increasingly, attackers steal confidential information before encrypting systems, threatening to publish or sell it unless a payment is made. Some dispense with encryption altogether, relying on the potential consequences of a data breach to force organisations into negotiations.
The shift is reflected in Palo Alto Networks’ 2026 Global Incident Response Report, which found that encryption featured in 78 per cent of cyber-extortion cases investigated in 2025, compared with 92 per cent in 2024. Data theft was involved in 57 per cent of cases, while harassment tactics appeared in 10 per cent.
These tactics can include contacting employees, customers or business partners directly, threatening to release confidential documents or attempting to sell stolen information. Even organisations that successfully restore their systems may face reputational damage, regulatory scrutiny and further extortion attempts.
The financial pressure remains considerable. According to Sophos’ State of Ransomware 2026 report, the average cost of recovering from a ransomware incident reached $1.7 million, an increase of 11 per cent on the previous year. The study, based on responses from 2,158 IT and security leaders whose organisations had experienced ransomware attacks, also found that 66 per cent of victims whose data was encrypted used backups to recover.
While these figures demonstrate the continued importance of backups, recovering access to systems does little to address information that criminals have already stolen.
Paying an extortion demand offers no reliable assurance that the information will be deleted either. In July 2026, ransomware incident response company Coveware highlighted how the LockBit criminal group had retained victims’ stolen data despite promising to delete it following payment. The discovery raised questions about the assurances organisations receive when negotiating with cyber-criminals.
For chief information security officers (CISOs), these developments require a broader approach to ransomware preparedness. Protecting backups remains essential, but organisations also need to reduce the opportunities for attackers to access and extract sensitive information.
This begins with understanding where critical data is stored, who can access it and how it moves between systems. Restricting unnecessary permissions, monitoring unusual data transfers and segmenting networks can help limit the information available to attackers if they gain access.
Identity security is particularly important. The Sophos research found that 79 per cent of ransomware incidents began with an identity-related attack method, including malicious emails, phishing and compromised credentials. Strengthening authentication and reviewing privileged access can therefore reduce opportunities for attackers to move through corporate networks.
Organisations must also prepare for the consequences of data theft. Incident response plans should address potential information exposure, legal and regulatory reporting obligations, communications with affected customers and the possibility of criminals contacting third parties directly.
The US National Institute of Standards and Technology (NIST) addressed these wider risks in its updated ransomware risk management guidance published in 2026. The framework covers prevention, detection, response and recovery, including situations where attackers threaten to disclose stolen information.
Testing these procedures is as important as documenting them. Exercises should consider scenarios where systems remain operational but confidential information has been stolen, requiring decisions about customer notification, regulatory responsibilities and potential extortion demands.
Backups will continue to play a central role in ransomware defence, particularly when organisations need to restore essential services quickly. However, the growing use of data theft and third-party pressure means that recovery planning must account for consequences that cannot be resolved by restoring files.
Security teams should assess their ability to detect data exfiltration, contain compromised accounts and respond to threats of disclosure. These capabilities can help limit the damage even when attackers have already gained access to sensitive information.
Click Here For The Original Source.
——————————————————–
