For years, the ransomware conversation has followed a familiar script. Systems go down. Files are encrypted. Operations stall. Executives ask whether the company can restore from backup or whether it has to pay.
That scenario still happens. But an industry wide report published last month suggests the threat has divided into parallel tracks.
Lead Cybersecurity Analyst at Fortra.
The report, drew from hundreds of real-world incident response engagements, found that data-only extortion incidents surged eleven times year over year, growing from 2% to 22% of cases.
Verizon’s 2025 Data Breach Investigations Report reflects this broader evolution by treating ransomware with or without encryption as part of the same extortion landscape, noting that ransomware appeared in 44% of breaches it reviewed.
Rethinking how companies define resilience
This should force a rethink in how companies define resilience. Too many organizations still approach ransomware as if it were primarily an operational recovery problem. The key question becomes how quickly systems can be restored, whether backups are isolated, and how much downtime the business can tolerate.
Those are still important questions. They are just no longer sufficient. It begins once attackers shift from availability loss to confidentiality loss, the entire decision model changes.
The immediate questions are no longer only technical. What data was taken? Who owns it? Was it a customer database, regulated data, intellectual property, internal communications, or some mix of all of the above? Was it stored in a core environment, duplicated in SaaS platforms, shared with a vendor, or retained years longer than necessary?
If leadership cannot answer those questions quickly, it may recover systems but still fail to mitigate the larger fallout.
Recent reporting from Coveware underscores why this shift matters. In its Q2 2025 ransomware analysis, exfiltration appeared in 74% of cases, and the firm described data theft as the main event in many attacks rather than merely a precursor to encryption.
Threat actors are optimizing for pressure, not just disruption. The data itself has become the hostage.
Double extortion remains part of the playbook
This does not mean encryption has disappeared from ransomware. In many double extortion campaigns, it remains a core part of the playbook. The point is that theft of sensitive data now often carries enough leverage on its own that backups, while still essential, no longer define preparedness.
This makes the old backup-centric story increasingly incomplete. Backups remain essential. CISA continues to emphasize them, especially offline and tested recovery copies, while also warning that automated cloud backups can be insufficient if encrypted files sync back into the environment and overwrite clean versions. But that guidance points to a broader truth.
That restoration is only one part of resilience. This is also where the market is quietly catching up to the threat. It is not accidental that more of the security industry is emphasizing data protection and data visibility rather than treating ransomware purely as a recovery problem.
That shift reflects a broader reality: organizations are realizing that resilience is no longer just about restoring systems after disruption. It is about reducing uncertainty around data exposure before a crisis forces the question.
The single lens of disaster recovery
That idea deserves more attention in board rooms, security war rooms and with clients. Many enterprises have been taught to view ransomware readiness through the single lens of disaster recovery. Many MSPs still package it in this way as well. The language centers on data recovery time objectives, backup testing, and business continuity.
But in a data theft-led extortion model, the more revealing measure of maturity is whether an organization actually knows where its sensitive data lives, how it moves, who has access to it, and whether it should still exist at all. NIST’s Cybersecurity Framework 2.0 points in that direction.
Its implementation examples explicitly call for maintaining inventories of designated data types and corresponding metadata, including provenance, data owner, and geolocation.
It also ties lifecycle management to reducing unnecessary exposure, including securely destroying stored data based on retention policy and identifying redundant systems and services that increase attack surface. NIST’s current incident response guidance makes the point even more directly.
It states that data inventories including classifications, owners, and logical and physical locations provide valuable information on what data may have been involved in an incident. That is exactly the problem many organizations discover too late.
Understanding the true data attack surface
This is where ransomware, privacy, governance, and business strategy collapse into the same event. A single intrusion can become an operational disruption, a legal problem, a customer trust crisis, a regulatory reporting exercise, and a competitive exposure issue all at once.
That is why the old question, “Do we have backups?” now feels too narrow. The harder and more useful question is whether the company understands its true data attack surface before the intrusion happens. There is also a deeper organizational issue here.
Many enterprises have improved recovery architecture while allowing data sprawl to worsen. Sensitive files are copied across collaboration platforms, cloud repositories, shared drives, unmanaged endpoints, and third-party systems. Legacy data remains because no one wants to own deletion decisions.
Access accumulates faster than it is reviewed. In that environment, a company may look resilient on paper while quietly carrying enormous extortion leverage inside its own estate.
The strategic lesson
The strategic lesson is not that backups matter less. It is that backups solve a different problem. They help recover systems. They do not restore secrecy, trust, or negotiating position once data has been taken. In the extortion era, resilience has to become more data-centric.
That means better classification, tighter identity management controls around high-value repositories, stronger visibility across cloud and third-party environments, and more disciplined retention practices so attackers have less to steal in the first place. It also means more honest conversations with clients and boards about the difference between operational recovery and genuine resilience.
The companies that navigate this best will not be the ones with the fastest recovery time. They will be the ones that never had to guess what was taken. Backups are infrastructure. Understanding your data is strategy. In the current threat environment, the gap between those two things is exactly where extortion lives.