Why do ransomware groups increasingly use double and triple extortion instead of simple encryption alone?

Why Encryption Alone Stopped Being Enough

Simple encryption creates a narrow bargain: the victim may lose access, but the attacker only benefits if the organisation cannot restore quickly or cannot tolerate downtime. Once recovery became more routine, ransomware crews needed a second pressure point. That pushed them toward data theft, disclosure threats, and broader extortion leverage that survives even when backups work.

Encryption still matters, but it is no longer the only source of pain. In many incidents, the real leverage comes from forcing a victim to choose between operational disruption and the consequences of exposed data, leaked intellectual property, or customer notification obligations. That shift changes ransomware from a locking problem into a bargaining problem.

Attackers also learned that encryption can be partially neutralised by resilience investments such as backups, recovery testing, and segmentation. When those controls reduce downtime, the criminal model has to adapt. Double and triple extortion raise the odds of payment because they create parallel forms of harm that are harder to restore than a file system.

How Double and Triple Extortion Increase Pressure

Double extortion usually combines encryption with exfiltration and the threat of public release. Triple extortion adds another layer, such as direct pressure on customers, partners, or employees, or disruption of downstream services to widen the damage. The technique is effective because it expands the audience that feels the incident and increases the number of decisions the victim must make under stress.

This is especially powerful when the victim can restore systems but still faces legal, regulatory, contractual, or reputational consequences from stolen data. The attacker no longer needs to win on availability alone. They can point to privacy exposure, business interruption, or third-party harm as reasons to pay, even when technical recovery is possible.

The model also scales well for attackers. Data theft can be automated during initial access, while public leak sites and partner pressure are cheap to operate. That means the criminal can convert one compromise into multiple leverage points without needing a more sophisticated payload.

For a useful threat landscape view of how ransomware and extortion evolve across sectors, see the ENISA Threat Landscape and CISA’s cyber threat advisories.

What Makes This Model Attractive to Ransomware Groups

Double and triple extortion work because they exploit what victims value most: continuity, confidentiality, trust, and regulatory exposure. A business may decide it can survive a restore, but not a public leak of employee records, source code, customer data, or contract information. That makes the payment decision less about IT recovery and more about business risk containment.

The approach also reduces the attacker’s dependence on perfect encryption. If the victim can decrypt or rebuild, the threat still stands because stolen data, social pressure, and reputational damage remain. In practice, that means the attacker’s leverage survives longer than the malware itself.

Groups also use the model to diversify their extortion outcome. Some victims pay to stop disclosure, some to stop follow-on harassment, and some to contain downstream fallout from customers, suppliers, or regulators. That diversity makes the business model more resilient for the attacker and harder to predict for defenders.

Where machine compromise, stolen credentials, or exposed cloud material enable the initial access path, the follow-on leverage often comes from the GitLocker GitHub extortion campaign and the 230M AWS environment compromise, both of which show how access and data exposure can be turned into extortion pressure.

Risk and Threat Considerations

Double and triple extortion increase the likelihood that a ransomware event becomes a confidentiality, legal, and reputational crisis, not just an availability incident. Organisations that focus only on restore speed can still be exposed if data theft, partner disclosure, or public leak pressure are not contained.

Failure mechanism: The attacker steals data before or during encryption, then uses publication threats, third-party pressure, or targeted harassment to create independent leverage even when recovery is technically possible.

Impact: Victims may face breach notification duties, customer loss, regulatory scrutiny, negotiation pressure, and higher payment likelihood even after backups or rebuild options are available.

Practitioner Guidance

What to prioritise: Treat data theft and extortion signaling as first-class incident dimensions, not as a side effect of encryption. If exfiltration is plausible, your response plan should assume the attacker is already preparing a disclosure narrative.

What to verify: Confirm whether the compromise touched sensitive datasets, privileged repositories, customer records, or partner-facing material. The key question is not only whether systems can be restored, but whether the stolen data would materially change the business decision if published.

Practitioner takeaway: The stronger your restoration capability, the more important it becomes to reduce data exposure, because modern ransomware pressure is often designed to survive a successful recovery.

Related resources from NHI Mgmt Group

• Why do criminal groups increasingly use crypto to launder proceeds instead of cash-based methods?
• What is the difference between encryption-only ransomware and double extortion ransomware?
• What breaks when defenders rely on backups alone against double-extortion ransomware?
• When should organisations use OAuth with JWT instead of one alone?