A Forbes Tech Council op-ed published in November 2026 argues that artificial intelligence has moved from a minor supporting role to a lead role in ransomware. The piece describes how AI-powered ransomware as a service (RaaS) is changing the work involved in an extortion attack, from sorting stolen data to drafting the ransom demand itself. For ordinary users and small organizations, the practical message is that the basics of defense matter more, not less.
A note on sourcing: the excerpt available to us is brief, so this article sticks to the claims it contains and treats the sellers' descriptions as claims, not verified capabilities.
How AI is changing the ransomware playbook
According to the op-ed, attackers who once handled each step of an operation by hand can now offload parts of the work to AI. One example it highlights is ranking stolen databases by how much they would be worth in an extortion demand. Instead of a person reading through files to decide what has leverage, a model can sort the haul and point the attacker at the most valuable material first.
This matters because ransomware has long depended on time and skill. Reviewing stolen data, deciding what to threaten to publish, and writing a convincing demand all take effort. When software handles those tasks, less experienced criminals can run more capable operations, and experienced ones can run more of them at once.
Inside LLM-run RaaS control panels
The op-ed also points to a further step: some newer RaaS kits have control panels run by a large language model (LLM). Ransomware as a service is a model in which developers sell or rent ransomware tools to affiliates who carry out the attacks. The article says sellers claim the LLM-driven panels can perform several actions, including:
- Scanning infected machines
- Keeping track of several victims at the same time
- Writing ransom notes
These are seller claims, and the excerpt does not offer independent testing of how well they work. Still, the direction is clear. The control panel, which used to be a dashboard that a human operator had to drive, is becoming an assistant that manages the workflow. The result is a lower skill barrier and potentially more victims handled by fewer people.
It is worth keeping this in proportion. Nothing in the excerpt suggests the underlying methods of getting in have changed. Attackers still need a way into a system, such as stolen credentials, an unpatched flaw, or a phishing message. AI speeds up what happens afterward.
Why exposed personal data makes extortion worse
If a model can rank stolen databases by extortion value, then the kind of data you leave exposed becomes more important. Records that contain identity details, health information, or financial data are the sort of material that can carry the most pressure in a demand. The more of it that sits in one place, the easier it is to sort and weaponize.
A real-world example of how leaked records circulate is the CONAPE data leak, where a threat actor using the name "sqx" claims to have leaked 6 million records from the Dominican Republic's national council for older adults. Whatever the specifics of that case, it shows how large collections of personal records become raw material for extortion and fraud, and why people in those datasets face risk long after the initial incident.
Practical protections: backups, MFA, patching and data minimization
AI may change how attackers work, but the most effective defenses are still the familiar ones. They also work against the full chain, from entry to extortion.
- Keep offline or immutable backups. If your files are encrypted, a clean backup you can restore from removes much of the attacker's leverage. Test the restore process, not just the backup.
- Turn on multi-factor authentication (MFA). Stolen passwords are a common way in. MFA on email, cloud storage, and remote access makes them far less useful.
- Patch promptly. Update operating systems, apps, routers, and any internet-facing software as soon as fixes are available.
- Minimize the data you hold and share. Backups do not help if stolen data is published. Delete accounts you no longer use, avoid handing over optional personal details, and for organizations, retire records you no longer need. Data that does not exist cannot be ranked, sold, or threatened.
- Be skeptical of polished messages. If AI writes better ransom notes, it can also write better phishing emails. Verify unexpected requests through a separate channel.
What This Means For You
For individuals, the main change is that attackers may get faster and more polished, not that the defenses are obsolete. Strong, unique passwords with MFA, regular updates, and tested backups still stop or blunt a large share of attacks. Reducing the amount of personal data you scatter across services limits what can be used against you if one of them is breached.
For small businesses, which often lack dedicated security staff, the lower skill barrier is the key concern. You may be a target not because you are prominent but because automation makes more victims worth pursuing. Treat basic hygiene as a requirement.
Takeaways
The Forbes Tech Council op-ed shows how AI-powered ransomware as a service could make extortion cheaper and more scalable. You cannot control how attackers build their tools, but you can control how much they find when they get in.
- Set up offline backups and test them.
- Enable MFA on every important account.
- Install updates promptly.
- Cut back on the personal data you expose or store.
To see how leaked records spread and why they matter, read our report on the CONAPE data leak, then take ten minutes to check your own backups and account security today.
