Ransomware: The Data Only Extortion in 2026

The data only extortion has become the ransomware variant the operator has been running since 2023, the variant where the operator does not bother with the encryption, the variant where the operator just takes the data and demands the ransom. The honest framing matters here, because the data only extortion the backup strategy was supposed to defeat sits as the extortion the backup cannot defeat, the backup that protects against the encryption, not the extortion, the extortion the postmortem will describe as the variant the enterprise had not prepared for.

What follows runs as the working version of the field guide. The shorter version is what the security team and the operations team actually have time to read.

How the data only variant works

Here is the working order, by impact. The first runs as the data theft, where the theft the operator runs before the operator does anything else, the operator that quietly exfiltrates the customer data, the financial data, the source code, the operator that compresses the data and uploads the data to the cloud storage the operator controls, the theft that takes the weeks the operator needs to collect the high value dataset. The second runs as the notification, where the notification the operator sends when the theft is complete, the operator that posts the sample of the stolen data on the leak site, the operator that emails the enterprise with the ransom demand, the operator that gives the enterprise the deadline the enterprise has to respond to. The third runs as the escalation, where the escalation the operator runs when the enterprise does not pay, the operator that dumps the next tranche of the data, the operator that contacts the customers the operator found in the stolen data, the operator that turns the data breach into the public relations incident the enterprise cannot contain.

What it changed about the response

Here is the working order, by impact. The first runs as the backup is not the answer, where the answer the enterprise thought the backup would be, the backup that protects against the encryption, the backup that does not protect against the data theft, the backup that the operations team invested in for the variant the operator is no longer running. The second runs as the detection sits as the answer, where the answer the enterprise has to invest in now, the detection that catches the data exfiltration the operator is running, the detection that alerts the SOC team before the operator finishes the upload, the detection that costs the SIEM the enterprise has been wanting. The third runs as the legal exposure runs as the answer, where the answer the enterprise has to plan for now, the legal exposure that the data breach notification triggers, the regulatory fine, the customer lawsuit, the exposure that the backup strategy did not have to plan for.

What the defender can do

Three moves if you are the security or operations team that wants to defend against the data only extortion the backup cannot stop. Detect the exfiltration, where the detection the security team deploys (the Netskope, the Zscaler, the cloud DLP), the detection that catches the gigabyte upload the operator is running, the detection that alerts the SOC the moment the upload starts, the detection that gives the IR team the time to respond before the operator finishes the theft. Minimise the data the operator can take, where the minimisation the operations team applies (the data classification, the retention policy, the access control), the minimisation that reduces the data the operator can exfiltrate, the minimisation that limits the damage the operator can threaten, the minimisation the operations team can do without the major architecture change. Plan the legal response, where the response the legal team prepares in advance, the response that names the regulator the enterprise has to notify, the response that names the customer the enterprise has to notify, the response that the CISO has rehearsed with the legal team before the breach, the response the enterprise can launch on day one rather than day thirty. The team that detects, minimises, and plans serves as the team that has defended against the data only extortion.

The bottom line

Data only extortion in 2026 sits as the variant the operator has been running because the backup cannot stop the operator. The data theft, the notification, the escalation, those three are how the variant works. The backup is not the answer, the detection counts as the answer, the legal exposure amounts to the answer, those three are what it changed. The detect, the minimise, the legal plan, those three are the defender moves. The team that does the three holds the data. The team that has only the backup does not.