When you think of ransomware, you probably picture a worst-case scenario: your systems are locked, your files encrypted, and a message on the screen demands cryptocurrency in exchange for the decryption key. For years, that’s been the dominant cyberattack model. But a new, stealthier threat is rapidly gaining ground—and it doesn’t involve encryption at all.

Welcome to the era of encryption-less extortion. Also known as pure extortion or data extortion, this emerging threat skips the encryption step entirely. Instead, attackers gain access to your systems, quietly steal your sensitive data, and then threaten to leak it unless a ransom is paid. No malware alert. No file recovery options. Just a raw, unfiltered shakedown. And it’s working.

What Is Encryption-less Extortion?

Encryption-less extortion is a form of cyberattack where the threat actors infiltrate a network, exfiltrate high-value data, and demand payment in exchange for not releasing it to the public, competitors, or regulatory authorities. It’s often part of the evolving ransomware landscape—but without the ransomware itself.

This tactic is particularly dangerous because it renders your standard ransomware defenses—like backups or disaster recovery plans—largely ineffective. You might still have access to your systems, but the attackers have something even more powerful: your sensitive data. Whether it’s personal identifiable information (PII), internal emails, trade secrets, or financial records, the attackers leverage the threat of exposure, not data loss, to extort their victims.

Why Are Attackers Skipping Encryption?

There are a few reasons why this trend is gaining momentum:

• It’s faster and quieter. Encryption takes time and increases the chances of being detected. By skipping that step, attackers can move more stealthily through networks.

• Backups don’t help. Many organizations have gotten better at restoring from backups to avoid paying ransoms. Extortion-less encryption bypasses this fallback entirely.

• The damage is more personal. Data leaks can be more reputationally devastating than system outages, especially if sensitive information is involved.

Some attackers even add psychological pressure by emailing executives, contacting customers directly, or leaking small samples of data to prove they mean business.

Real-World Examples

• In 2023, the City of Oakland suffered a data extortion attack in which hackers exfiltrated personal data from city employees. Although systems remained accessible, the attackers published gigabytes of data after ransom demands were ignored.

• In the healthcare sector, attackers are targeting hospitals and clinics with stolen patient data—threatening public leaks unless they’re paid. The reputational and legal implications of exposing protected health information (PHI) are often enough to make victims pay quietly.

• Even law firms and financial services firms are targets—holding sensitive emails, contracts, and trade information that could be devastating if made public or sold.

Who’s at Risk?

The reality is, no industry is safe. But certain sectors are particularly attractive to cybercriminals due to the nature of data they store:

• Healthcare: Patient records, insurance info, and medical histories fetch high prices on the dark web.

• Legal and financial: These firms manage highly sensitive documents that, if exposed, could lead to lawsuits or regulatory investigations.

• Public sector: Municipal governments and public institutions often lack modern cybersecurity infrastructure—and hold troves of sensitive citizen data.

• Manufacturing and tech: IP theft is a major concern, especially when proprietary designs or source code are exfiltrated.

In many cases, attackers are performing extensive reconnaissance, identifying your most valuable digital assets before making their move. 

How Should Organizations Respond?

So, what does defense look like in a world where data exfiltration—not encryption—is the weapon of choice?

1. Prioritize Data Protection, Not Just Availability

Many organizations focus on keeping systems running and minimizing downtime. But in the case of data extortion, availability isn’t the problem. Confidentiality is. Start with data classification—understanding what sensitive data you hold, where it resides, and who has access to it. Then apply encryption, even internally, wherever feasible. Only those who require access to sensitive data should have the ability to access it at any given time.

2. Implement Strong DLP and EDR Solutions

Data Loss Prevention (DLP) tools can help monitor and block unauthorized transfers of sensitive information. Endpoint Detection and Response (EDR) and Extended Detection and Response (XDR) solutions provide visibility into abnormal behaviors, including data staging or exfiltration. These technologies can be particularly effective at identifying early signs of an attack, especially when paired with behavior analytics.

3. Adopt a Zero Trust Architecture

Zero Trust is more than a buzzword—it’s a necessary shift in mindset. Trust nothing by default. Continuously verify identity, device posture, and access context. Micro-segmentation, least privilege access, and identity-based controls limit attackers’ ability to move laterally within your network and access crown-jewel data.

4. Train Employees—Continuously

Social engineering remains a top entry point. A single stolen credential or successful phishing email can give attackers a foothold. Ongoing security awareness training helps reduce the likelihood of human error opening the door to extortion.

5. Strengthen Your Incident Response Plan

Most organizations have plans for ransomware or system outages, but fewer are prepared for data extortion scenarios. Your IR plan should cover how to assess what was exfiltrated; who to notify internally and externally; legal obligations for breach disclosure; communication strategy for media, customers, and regulators; and whether and when to engage law enforcement or a cyber negotiator.  Don’t wait for a breach to figure this out. Practice tabletop exercises that simulate these new types of attacks.

Wrapping Up

The rise of encryption-less extortion changes the conversation around cybersecurity. This is no longer just about business continuity—it’s about protecting your reputation, your customers, and your future. Attackers are evolving. Are you? Now is the time to re-evaluate your cybersecurity posture, modernize your tools and training, and proactively address the threat of data extortion before it becomes your organization’s crisis.