Double extortion is a ransomware tactic with two levers. The attackers encrypt the victim’s systems and also steal a copy of the data. They then demand payment both for a decryption key and for a promise not to publish the stolen files. CISA uses the term for this combination of encryption and threatened data release.

How it works

• Attackers gain access and quietly carry out data exfiltration before running the ransomware.
• The ransom note warns that the data will be posted on a data leak site.
• Good backups solve the encryption problem but not the leak threat, which keeps the pressure on.
• In triple extortion, attackers add more pressure, such as contacting customers or launching denial-of-service attacks.

CISA also notes that some actors skip the encryption and rely only on the threat to release stolen data.

Why it matters for dark web monitoring

With double extortion, a ransomware incident is also a data breach, with possible duties under laws such as the GDPR. Watching leak sites and criminal channels helps an organization see whether its data, or data held by a supplier, has been posted. It also shows what was published, which supports incident response. Services that watch for leaked data cover these sites.

Sources: CISA: #StopRansomware Guide, NCSC: Ransomware, extortion and the cyber crime ecosystem