---
title: "One extortion case in three now skips encryption and just steals the data"
summary: "LevelBlue's incident-response cases and Coveware's ransom payments, January to September 2026: extortion with no encryption, and what it changes for buyers."
url: https://www.thetechbag.com/blog/extortion-without-encryption-data-theft-rises
format: Trend
desk: "Security operations"
published: 2026-10-29
facts_checked: 2026-10-29
author: TechBag (The TechBag Journal)
tags: ["data extortion","ransomware","exfiltration","LevelBlue","Coveware","Silent Ransom Group","DLP","egress monitoring","OAuth","CERT-In","DPDP Rules"]
cover: https://www.thetechbag.com/blog/covers/extortion-without-encryption-data-theft-rises.png
---

# One extortion case in three now skips encryption and just steals the data

*LevelBlue's incident-response cases and Coveware's ransom payments, January to September 2026: extortion with no encryption, and what it changes for buyers.*

Trend · Security operations · By TechBag · Published 2026-10-29 · Facts checked 2026-10-29 · Canonical: https://www.thetechbag.com/blog/extortion-without-encryption-data-theft-rises

The short version

- In LevelBlue’s incident-response cases, extortion with no encryption at all rose from 20% of ransomware and extortion intrusions in the first quarter of 2026 to 23% in the second and 33% in the third.[1]
- Payments moved in opposite directions. Coveware’s median ransom paid rose 167% in the third quarter to US$400,000; the average fell 45% to US$1,025,278.[3]
- A backup restores locked systems; it does nothing about data already copied out. Detection of data leaving, and a decision the board has taken in advance, now carry more of the weight.

One ransomware and extortion case in three that LevelBlue investigated between July and September involved no ransomware: the attackers copied the data and threatened to publish it. LevelBlue, a managed security and incident-response firm, published that on 28 October;[1] the same day, Coveware by Veeam, which negotiates on behalf of victims, opened its quarterly report with the line that ransomware “is increasingly shedding the ‘ware’ in favor of pure, low-friction data extortion.”[3] Both firms count their own clients, not the whole market. Here is what each measured, how each explains it, and what it changes for the people who buy security.

## The line: from a fifth to a third in two quarters

LevelBlue sorts the ransomware and extortion intrusions it handles into three kinds. Encryption plus theft remained the largest, but its share fell each quarter this year, from 60% to 54% to 50%. Theft-only extortion went from 20% to 23% to 33%, the fastest-growing category. Encryption without theft rose to 23% in the second quarter and fell to 17% in the third.[1]

**Figure: Extortion with no encryption grew from a fifth to a third of LevelBlue's cases**

*Share of ransomware and extortion intrusions by type, LevelBlue incident-response cases, Q1 to Q3 2026*

|  | Theft only, no encryption | Encryption + theft | Encryption only |
| --- | --- | --- | --- |
| Q1 2026 | 20 | 60 | 20 |
| Q2 2026 | 23 | 54 | 23 |
| Q3 2026 | 33 | 50 | 17 |

Source: LevelBlue, TTP Briefing Q3 2026 (chart: Intrusions) · as of 28 October 2026 · The three types sum to 100% each quarter. LevelBlue does not publish the number of cases behind the shares

Read the other way, data was taken in 83% of the third quarter’s intrusions and systems were encrypted in 67%; in the second quarter both stood at 77%.[1] Across every kind of incident LevelBlue handled, including email fraud, network intrusions without ransomware were 22% and ransomware 20%.[1]

## What drives it, as the two reports explain it

LevelBlue’s theme for the quarter was that “attackers didn’t need to break in so much as log in”: session tokens captured by phishing kits, OAuth apps users had consented to, VPN appliances that accepted forged authentication, and remote-management tools that look like routine IT.[1] Where business email accounts had multi-factor authentication, attackers got past it in 79% of cases, often by talking the user into enrolling the attacker’s device.[1] In earlier quarters LevelBlue gave two reasons for intrusions that end without ransomware: defenders stopping attackers before encryption, and attackers choosing to steal and extort instead.[2]

Coveware’s explanation is cost. It cites a leak of the Silent Ransom Group’s internal chats, which showed a group that had “largely abandoned network-wide encryption” for cloud and SaaS theft, social engineering and insiders; dropping encryption removes “the costly, labor-intensive deployment” and lets a group breach and extort quickly.[3] Phishing and social engineering were about 29% of Coveware’s initial access, remote access 22–23%.[3]

**Figure: The median payment rose 167% to US$400,000 while the average fell 45%**

*Ransom paid in Coveware by Veeam cases, US$ thousand, Q2 2026 to Q3 2026*

|  | Q2 2026 | Q3 2026 | Change |
| --- | --- | --- | --- |
| Median payment | 150 | 400 | 167% |
| Average payment | 1,881 | 1,025 | -46% |

Source: Coveware by Veeam, quarterly reports for Q2 2026 and Q3 2026 · as of 28 October 2026 · Average: US$1,880,612 in Q2, US$1,025,278 in Q3. Median: US$150,000, then US$400,000

Coveware reads the narrowing gap as a split market: higher demands squeezing mid-sized firms, and large enterprises “less willing to pay multimillion-dollar extortions when system availability is not compromised.” Its payment rates, overall and for theft-only cases, ticked up slightly but stay “near historic lows”; in the second quarter, 15% of theft-only victims paid.[3][4]

ReportedReported: the view against the trend

Coveware expects the shift may not last: given falling theft-only payment rates and the leak, “we anticipate some ransomware groups may revert to simpler impact tactics.” Impact, its stage for disruption such as encryption or service interruption, was already seen in 50% of its third-quarter cases, “a notable increase” on the second.[3] The two firms measure different caseloads; both are reported here.

## What it means for a buyer

**Backups no longer answer extortion on their own.** They still matter, because half of LevelBlue’s cases still encrypt. But in Coveware’s words, “data that has already left the network cannot be recovered.”[3] Our September piece on [August’s ransomware high](https://www.thetechbag.com/blog/ransomware-high-august-most-victims-dont-pay) set out the buyer’s test as Restore, Stop, Prove; this quarter’s data moves weight from the first to the other two.

**Detect data leaving, not only data locked.** LevelBlue: “Detection built around encryption events will miss a growing share of intrusions.” It names the signs: large outbound transfers, unusual archive creation, new cloud storage destinations, and tools such as rclone, MegaSync, WinSCP, 7-Zip and WinRAR. Its priorities for the fourth quarter add restricting user consent to OAuth apps, reviewing existing grants and rotating vendors’ API keys.[1]

TechBag countTechBag count: blocking data on its way out

Of 21 products in our DLP & Insider Risk guide, 15 document a blocking mode, 3 stop at coaching the user and 3 at monitoring. 14 cover cloud applications as a channel; 9 of those can block. Counts are of vendor documentation, not of tests.[8]

**Tell the board before, not during.** Coveware advises treating theft-only attacks “primarily as legal, governance, and communications crises rather than technical events”: paying “rarely alleviates regulatory or legal notification obligations”, and a promise to delete stolen data cannot be verified. The Silent Ransom Group leak itself named victims who had paid to keep their incident quiet.[3] The decision to pay or not, and who takes it, is one to settle in advance.

If you are buying this in India

In India, a theft with no ransomware is still a reportable incident. CERT-In’s Directions of 28 April 2022 list “Data Breach” and “Data Leak” among the incidents any body corporate must report “within 6 hours of noticing” them, and require logs of all ICT systems kept “for a rolling period of 180 days” within Indian jurisdiction.[5] From 13 May 2027, Rule 7 of the DPDP Rules adds a detailed report to the Data Protection Board “within seventy-two hours of becoming aware of the breach” where personal data is involved.[6][7] Those logs are what answers the question an extortionist, a regulator and a customer all ask: what left. In our DLP guide, 4 of the 21 products are built in India and 2 more document Indian data residency.[8] Neither report gives an India figure.

**What to watch.** LevelBlue presents the quarter in webinars on 10 and 12 November, and Coveware says its full third-quarter report is “coming soon”.[1][3] The next data points are the fourth-quarter reports: LevelBlue published this year’s first three between three and five weeks after each quarter ended,[1][2] and Coveware’s report for the fourth quarter of 2025 came on 3 February 2026.[9] The test is whether theft-only extortion passes a third of LevelBlue’s cases, or whether Coveware’s expected return to disruption shows first.

How we did this

Figures as of 29 October 2026

Written as of 29 October 2026, using only documents public by then. The three-way split is LevelBlue’s, read from the labelled “Intrusions” chart in its Q3 2026 briefing post; the 83%, 67% and 77% figures, the incident-type shares and the defender priorities are from the post and the report PDF. LevelBlue counts its own incident-response engagements and SpiderLabs intelligence, excludes managed-detection clients from dwell time, and publishes no case count. Coveware’s figures are from incidents it supported; its Q3 payment rates are given only as a direction and are not quoted as numbers. The two firms’ caseloads differ and neither is a market total. The DLP counts are TechBag’s, from the guide as it stood on this date, counting documented capability only.

Spotted an error? Write to us; corrections are published at the foot of the piece.

Sources

1. [LevelBlue SpiderLabs: LevelBlue TTP Briefing Q3 2026: Trusted Access Fuels Data Theft (with the report PDF)](https://www.levelblue.com/blogs/spiderlabs-blog/levelblue-ttp-briefing-q3-2026-trusted-access-fuels-data-theft) — 28 October 2026
2. [LevelBlue SpiderLabs: LevelBlue TTP Briefing Q2 2026: Stolen Identities Outpace Defenses](https://www.levelblue.com/blogs/spiderlabs-blog/ttp-briefing-q2-2026) — 23 July 2026 The Q1 2026 briefing is dated 5 May 2026.
3. [Coveware by Veeam (Bill Siegel): Ransomware Payment Trends Q3 2026, The Silent Ransom Group Leak Shows Why Paying for Silence Fails](https://www.veeam.com/blog/cyber-extortion-payment-trends-q3-2026.html) — 28 October 2026 Updated 29 October 2026.
4. [Coveware: Adverse cyber extortions are more common than commonly advised (Q2 2026 report)](https://coveware.com/2026/07/adverse-cyber-extortions-are-more-common-than-commonly-advised/) — 29 July 2026
5. [CERT-In, Directions under sub-section (6) of section 70B of the IT Act, 2000 (No. 20(3)/2022-CERT-In), paras (ii) and (iv), Annexure I items xi and xii](https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf) — 28 April 2022
6. [Digital Personal Data Protection Rules, 2025, Rule 7 (intimation of personal data breach), text of G.S.R. 846(E)](https://dpdpa.com/dpdparules/rule7.html) — 13 November 2025 Reproduction of the Gazette text.
7. [Legismith: DPDP Rules 2025 commencement timeline (Rule 7 from 13 May 2027)](https://legismith.com/dpdp-rules-2025-timeline/) — notified 13 November 2025
8. [TechBag, DLP & Insider Risk guide: 21 products; enforcement mode, channel and India fields](https://www.thetechbag.com/browse/data-security-privacy/dlp-insider-risk) — vendor documentation verified 24 August 2026
9. [Coveware: Why Zero-Day Downstream Mass Data Extortion Campaigns are Losing Their Bite (Q4 2025 report)](https://coveware.com/2026/02/why-zero-day-downstream-mass-data-extortion-campaigns-are-losing-their-bite/) — 3 February 2026

Related on TechBag: the [DLP & Insider Risk guide](https://www.thetechbag.com/browse/data-security-privacy/dlp-insider-risk) compares which products can block data leaving; the [SASE & SSE guide](https://www.thetechbag.com/browse/network-security-sase/sase-sse) covers inline inspection of web and cloud traffic; the [Cyber Recovery guide](https://www.thetechbag.com/browse/backup-cyber-resilience/cyber-recovery) covers the half of the attack that still encrypts.

**Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.

Go deeper on TechBag

- [DLP & Insider Risk guide](https://www.thetechbag.com/browse/data-security-privacy/dlp-insider-risk) — which of 21 products can block data leaving, by channel
- [SASE & SSE guide](https://www.thetechbag.com/browse/network-security-sase/sase-sse) — inline inspection of web and cloud traffic on its way out
- [Cyber Recovery guide](https://www.thetechbag.com/browse/backup-cyber-resilience/cyber-recovery) — for the half of the attacks that still encrypt