Data theft extortion

A growing share of extortion never encrypts anything. The data is copied out, and the threat is simply to publish it.

Nothing stops working, which removes the thing people had prepared for. Backups are irrelevant, because nothing has been lost. The pressure is legal and reputational instead: regulators to notify, customers to tell, information you cannot get back once it is public. Organisations that planned entirely around restoring from backup often discover they had built a recovery plan for a different crime.