What happens when ransomware attackers steal data as part of the encryption process?

Why This Matters for Security Teams

When ransomware operators steal data before or during encryption, the event changes from a pure recovery problem into a broader extortion and disclosure problem. The attacker can pressure the organisation even if backups are clean, because the threat now includes publication, resale, or selective leakage of sensitive records. That shifts incident response, legal review, customer notification, and board reporting into the first hours of the case, not the last. Guidance from CISA cyber threat advisories is useful here because it helps teams recognize current attacker patterns and map them to response priorities.

Security teams often underestimate how quickly a double-extortion case expands the blast radius. File restoration may solve availability, but it does not remove confidentiality exposure, credential theft risk, or evidence preservation duties. The attacker may already have copied backup catalogs, cloud shares, email archives, or identity data that can be used for follow-on fraud.

In practice, many security teams encounter the legal and reputational impact only after the ransom note appears, rather than through intentional preparation for data theft as part of the intrusion.

How It Works in Practice

Most double-extortion intrusions follow a familiar sequence: initial access, privilege escalation, lateral movement, discovery, exfiltration, and then encryption. The theft phase may happen quietly over hours or days, often using legitimate tools, remote management channels, or encrypted outbound traffic that blends into normal operations. The encryption step is then used to create operational urgency while the stolen data gives the attacker leverage.

The practical response is to treat the event as both a containment incident and a data security incident. That usually means preserving logs, isolating affected segments, identifying which repositories were accessed, and determining whether the stolen data includes personal, regulated, or strategically sensitive information. The same event may also require password resets, token revocation, session invalidation, and review of non-human identities if service accounts or automation credentials were exposed.

• Confirm whether exfiltration occurred before assuming the problem is only file encryption.
• Check identity systems, cloud storage, collaboration tools, and backup infrastructure for unusual access.
• Prioritise evidence preservation so legal, insurance, and law enforcement review can rely on intact records.
• Map attacker behaviour to known intrusion patterns using the MITRE ATT&CK Enterprise Matrix to support detection and scoping.

Containment also needs to address the possibility that the attacker still has valid credentials, API keys, or remote access pathways after encryption begins. Without that step, restoration can simply restore the attacker’s opportunity to return. These controls tend to break down in hybrid environments with weak asset inventory and fragmented logging because exfiltration paths and identity abuse are hard to reconstruct quickly.

Common Variations and Edge Cases

Tighter response and notification controls often increase operational overhead, requiring organisations to balance rapid recovery against the need to verify what was actually stolen. That tradeoff becomes sharper when the affected data set is incomplete, duplicated across systems, or stored in third-party platforms.

Not every ransomware case includes meaningful exfiltration. Some crews rely on encryption only, while others take limited samples to prove access, and some focus on regulated records or executive data to maximise pressure. Best practice is evolving around how much evidence is enough to conclude that data was removed, so teams should avoid assuming that “no sign of theft” means “no theft occurred.”

Edge cases also matter when service accounts, automation tokens, or AI-connected systems are involved. If an attacker steals machine credentials, the incident can extend beyond human user accounts into scripts, pipelines, and agentic workflows. That creates a longer tail of risk because cleanup is not finished when laptops are rebuilt. Where ransomware is paired with AI-assisted reconnaissance or automated targeting, current threat research suggests that defenders should watch for faster discovery and more selective exfiltration than traditional playbooks anticipate.

When only the encrypted systems are restored and stolen data is left unverified, organisations can still face disclosure, extortion, and follow-on fraud after the technical recovery is complete.

Related resources from NHI Mgmt Group

• What fails when ransomware attackers steal patient records before encrypting systems?
• What happens to an educational institution after a serious data breach or ransomware attack?
• How should security teams prepare for ransomware when attackers move at AI speed?
• When should organisations treat NHI governance as part of ransomware defense?