One extortion case in three now skips encryption and just steals the data

01The line: from a fifth to a third in two quarters

LevelBlue sorts the ransomware and extortion intrusions it handles into three kinds. Encryption plus theft remained the largest, but its share fell each quarter this year, from 60% to 54% to 50%. Theft-only extortion went from 20% to 23% to 33%, the fastest-growing category. Encryption without theft rose to 23% in the second quarter and fell to 17% in the third.¹

Read the other way, data was taken in 83% of the third quarter’s intrusions and systems were encrypted in 67%; in the second quarter both stood at 77%.¹ Across every kind of incident LevelBlue handled, including email fraud, network intrusions without ransomware were 22% and ransomware 20%.¹

02What drives it, as the two reports explain it

LevelBlue’s theme for the quarter was that “attackers didn’t need to break in so much as log in”: session tokens captured by phishing kits, OAuth apps users had consented to, VPN appliances that accepted forged authentication, and remote-management tools that look like routine IT.¹ Where business email accounts had multi-factor authentication, attackers got past it in 79% of cases, often by talking the user into enrolling the attacker’s device.¹ In earlier quarters LevelBlue gave two reasons for intrusions that end without ransomware: defenders stopping attackers before encryption, and attackers choosing to steal and extort instead.²

Coveware’s explanation is cost. It cites a leak of the Silent Ransom Group’s internal chats, which showed a group that had “largely abandoned network-wide encryption” for cloud and SaaS theft, social engineering and insiders; dropping encryption removes “the costly, labor-intensive deployment” and lets a group breach and extort quickly.³ Phishing and social engineering were about 29% of Coveware’s initial access, remote access 22–23%.³

Coveware reads the narrowing gap as a split market: higher demands squeezing mid-sized firms, and large enterprises “less willing to pay multimillion-dollar extortions when system availability is not compromised.” Its payment rates, overall and for theft-only cases, ticked up slightly but stay “near historic lows”; in the second quarter, 15% of theft-only victims paid.³⁴

03What it means for a buyer

Backups no longer answer extortion on their own. They still matter, because half of LevelBlue’s cases still encrypt. But in Coveware’s words, “data that has already left the network cannot be recovered.”³ Our September piece on August’s ransomware high set out the buyer’s test as Restore, Stop, Prove; this quarter’s data moves weight from the first to the other two.

Detect data leaving, not only data locked. LevelBlue: “Detection built around encryption events will miss a growing share of intrusions.” It names the signs: large outbound transfers, unusual archive creation, new cloud storage destinations, and tools such as rclone, MegaSync, WinSCP, 7-Zip and WinRAR. Its priorities for the fourth quarter add restricting user consent to OAuth apps, reviewing existing grants and rotating vendors’ API keys.¹

Tell the board before, not during. Coveware advises treating theft-only attacks “primarily as legal, governance, and communications crises rather than technical events”: paying “rarely alleviates regulatory or legal notification obligations”, and a promise to delete stolen data cannot be verified. The Silent Ransom Group leak itself named victims who had paid to keep their incident quiet.³ The decision to pay or not, and who takes it, is one to settle in advance.