4 MIN READ
Picture the label. Ransomware in 2026 covers a portfolio of related attacks that share a payment mechanism and diverge on everything else. The label hides the fact that the industry has matured, professionalised, and diversified to the point where defending against the name alone is not a strategy.
Ransomware as a service is a $20B annual market now, and the major crews run like legitimate businesses. They have HR, project management, customer support for the victims paying the ransom. Their attacks have split into four patterns: encrypt and extort, data only extort, wiper, harassment. Each one needs a different defence. Treat the label as a single threat and you lose to at least one of the four.
The four patterns of ransomware in 2026
Four patterns, in roughly that order of damage. Encrypt and extort came first: a crew compromises the network, encrypts the data, posts the ransom note. Roughly 30 percent of victims paid in 2026, lower than the peak but still high enough to fund the industry. Data only extort followed: they exfiltrate the data, skip the encryption, and the ransom demand becomes a non disclosure threat. Around half the victims paid in 2026, because the data proves irreplaceable even when the systems recover. Wiper runs the same shape but refuses to provide the decryption key after the payment. Effective payment rate drops to zero, because payment was never the goal in the first place. Harassment came last, and arguably causes the most brand damage. They do not encrypt, they do not steal, but they contact the customers, the regulators, and the press claiming they did. The brand takes the hit regardless of whether the breach actually happened.
What the defences look like for each pattern
Four defences, mapped to the four patterns. Encrypt and extort: the security org needs an immutable backup, an offline copy, and a tested restore cadence. The defender who can restore from backup does not pay the ransom. Data only extort calls for classification, loss prevention, and exfiltration detection on the data team. Catching the exfiltration before the crew has the upper hand comes down to knowing where the sensitive data lives and watching the data leaving the network. Wiper uses the same tools (immutable backup) plus geopolitical awareness, because the wiper pattern comes from state actors. Harassment is a brand problem. The brand comms lead needs brand monitoring, a customer communication plan, and a regulator communication plan. A team that responds within hours does not lose the brand.
What the defender should be doing
Treat the label as four separate threats, not one. A defender who runs a single ransomware program will only be good at one of the four and useless against the other three. The procurement lead, the AppSec team, the IR lead, and the brand comms lead all need different runbooks, and the runbook that wins against encrypt and extort will not save anyone during a wiper.
Then invest in the immutable backup. Encryption based ransomware and wiper both collapse to the same defence: a backup that cannot be deleted by the same hands that encrypted the production data. Offline, a separate cloud account, true immutable storage, any of them work. A backup that can be reached by the attacker is not a backup.
Then build the data classification and the DLP. Data only extort depends on the data being valuable enough to pay for, and the way to make it not valuable is to know what the data is and where it lives. A DLP that is not configured to catch the exfiltration is not a DLP.
The bottom line
Immutable backup, data classification, brand response plan, and the willingness to treat the label as four separate threats. Pick all four and the defender comes out with the data, the brand, and the regulator. Pick one and the other three still own the response.
Sources & Further Reading
All claims in this article are sourced from primary documentation, vendor advisories, and reputable security researchers.
Spotted an error? Email the editor. Corrections are issued with a visible correction note.
Editorial standards. Every article on humanrequired.org is reviewed by a human editor before publication. AI may assist with drafting or research; final editorial control is human. Read the full standards.
