Cyber extortion is when attackers pressure a victim to pay by threatening harm, such as keeping data locked or publishing stolen data. It often appears alongside ransomware, but it can also happen without any encryption. The goal is payment under pressure.
- Also Called3other namesdigital extortion · data extortion · ransom demand
- Related Terms3linked entriesDouble extortion · Ransomware · Data leak site
What Is Cyber Extortion?
Cyber extortion means forcing someone to pay by threatening them through digital means. In ransomware cases, the NCSC says ransomware is a type of malware that prevents you from accessing your computer or the data stored on it. The NCSC also says attackers will threaten to publish data if payment is not made.
How Did Extortion Move Beyond Locked Files?
CISA’s #StopRansomware guide describes how the tactics have changed. Attackers exfiltrated victim data, meaning they copied it out of the victim’s network, and pressured victims to pay by threatening to release the stolen data. CISA says the use of both tactics is known as double extortion.
CISA also says that malicious actors may exfiltrate data and threaten to release it as their sole form of extortion without employing ransomware. So extortion does not always involve locked files.
What Does an Extortion Case Look Like Step by Step?
MITRE ATT&CK describes the actions below. Order and mix vary by group, and CISA notes that data theft can be used without any encryption.
- Copy data outStolen files leave through a legitimate web service.Technique T1567 (MITRE ATT&CK, opens in a new tab)
- Remove recoveryBackups and recovery tools are deleted or switched off.Technique T1490 (MITRE ATT&CK, opens in a new tab)
- Encrypt systemsFiles are locked and the key is withheld.Technique T1486 (MITRE ATT&CK, opens in a new tab)
- Demand paymentThe victim is pressed for money.Technique T1657 (MITRE ATT&CK, opens in a new tab)
MITRE says T1657 covers theft of money through extortion, including extortion by ransomware.
Why Can Good Backups Still Leave You Exposed?
Extortion puts pressure on a victim in more than one way. Locked systems stop work, and the threat of published data adds a second worry that backups alone do not remove. Because CISA says data theft can be used without ransomware, an organization with good backups can still face a demand. For that reason, it helps to think about stopping data from leaving the network as well as recovering from encryption.
What Should You Do When an Incident Happens?
Two of the steps in CISA’s response checklist are:
- Determine which systems were affected and immediately isolate them.
- Report the incident to CISA, your local FBI field office or the FBI Internet Crime Complaint Center.
Prevention steps such as backups, multi-factor authentication and patching are covered on the double extortion page.
The NCSC says law enforcement discourages paying, because there is no guarantee that you will get access to your data or computer and you will be paying criminal groups. It also says up-to-date backups are the most effective way of recovering from a ransomware attack.
Is Cyber Extortion the Same as Ransomware?
No. Ransomware is malware that blocks access to data or systems. Extortion is the pressure applied to get paid. Ransomware is one way to apply that pressure, and CISA says data theft threats can be used alone.
Is Extortion the Same as Double Extortion?
No. Double extortion is one pattern, in which data is both encrypted and stolen, and the victim is pressured on both counts.
Related Pages in the Knowledge Hub
- KillSec, a group that pairs data theft with threats
- Triple extortion explained
- Phishing 101, a common way in
Sources
- CISA: Double extortion; data exfiltration and release threats as sole extortion without ransomware; backups, MFA, patching, isolate, report.
- UK NCSC: Ransomware definition; attackers threaten to publish data; payment discouraged; backups most effective for recovery.
- MITRE ATT&CK: T1567 Exfiltration Over Web Service.
- MITRE ATT&CK: T1490 Inhibit System Recovery.
- MITRE ATT&CK: T1486 Data Encrypted for Impact.
- MITRE ATT&CK: T1657 Financial Theft, which covers extortion by ransomware.
Also Called.
- Namedigital extortion
- Namedata extortion
- Nameransom demand
Questions.
-
What is cyber extortion?
Cyber extortion is when attackers pressure a victim to pay by threatening harm, such as keeping data locked or publishing stolen data. It often appears alongside ransomware, but it can also happen without any encryption.
-
Is cyber extortion the same as ransomware?
No. Ransomware is malware that blocks access to data or systems. Extortion is the pressure applied to get paid. Ransomware is one way to apply that pressure, and CISA says data theft threats can be used alone without ransomware.
-
What is double extortion?
Double extortion is one pattern in which data is both encrypted and stolen, and the victim is pressured on both counts. CISA describes attackers copying data out of the victim's network and threatening to release it.
-
How can you reduce the risk of cyber extortion?
CISA recommends offline, encrypted backups that you test, phishing-resistant multi-factor authentication, and regular patching. If an incident happens, isolate affected systems and report it. Backups alone do not stop a threat to publish stolen data.
In Our Research
- 1 Cyber Threat Landscape Outlook: November 2026 to April 2027 November 2026
- 2 AI Ransomware: 4 AI Tools That Crews Use October 2026
- 3 Operation Serengeti III: How INTERPOL’s Latest Sweep Compares With the Last Two October 2026
- 4 What Is Triple Extortion? The Anatomy of the Encryption + Leakage + DDoS Trio April 2026
- 5 WIZARD SPIDER: The Financial Empire Behind Global Ransomware Operations January 2026
- 6 Forum Watch: What Cybercriminals Are Selling | Dark Web Insights November 2025