Ransomware Report: 37% of Payers Face Repeat Demands

Ransomware's Real Profit Engine Isn't Encryption

For years, ransomware defense has focused on one moment: the second files get locked. But new findings covered by The National CIO Review make clear that encryption is often the least valuable part of a ransomware attack for the criminals behind it. The real payoff comes from data theft, and that payoff doesn't stop when the ransom is paid or systems are restored.

According to the report, 54% of affected organizations paid a ransom demand. That alone isn't surprising given how disruptive encrypted systems can be. What stands out is what happened next: 37% of those organizations who paid later received another demand from the same or a different attacker. In other words, more than a third of victims who thought they'd closed the incident found themselves back at square one, negotiating again over the same stolen data.

Why Stolen Data Keeps Paying Attackers

Once attackers exfiltrate data before deploying encryption, they gain multiple, separate revenue streams that don't depend on the victim's systems staying locked. The report outlines several of these:

• Public disclosure threats: Attackers threaten to leak sensitive files unless a second payment is made, even after the original ransom for decryption keys.
• Resale of stolen data: Information gets sold on criminal marketplaces to other threat actors, regardless of whether the original victim paid anything.
• Credential abuse: Usernames, passwords, and access tokens found in stolen files get reused to compromise other accounts or systems, sometimes at partner organizations or vendors.
• Follow-on attacks: Details gathered from a breach, like network diagrams, vendor contracts, or internal communications, make future intrusions easier and more targeted.

This is why security researchers increasingly describe modern ransomware as a data theft problem with encryption attached, rather than the reverse. Encryption disrupts operations for days or weeks. Stolen data can be weaponized for months or years.

A recent example of this dynamic playing out publicly involved the Tata Electronics breach that leaked iPhone 18 Pro secrets, where a ransomware group calling itself World Leaks published sensitive unreleased product information after gaining access to internal systems. Cases like this illustrate how stolen corporate data retains value to attackers well beyond the initial intrusion, and how disclosure threats alone can force organizations into difficult decisions even without a working encryption payload.

Why Paying Doesn't Guarantee the Story Ends

The 37% repeat-demand figure deserves particular attention because it undercuts a common assumption: that paying a ransom closes the incident. In reality, once data has left an organization's network, the victim has no way to verify that copies were destroyed, that the attacker won't resell the information, or that a different group hasn't already obtained the same files. Paying addresses the encryption problem. It does nothing to address the data theft problem, because that data is already out of the victim's control the moment it's exfiltrated.

This has direct implications for how organizations think about ransomware readiness. Backup and recovery planning matters for getting systems back online, but it does nothing to prevent a leak, a resale, or a second extortion attempt. Preventing exfiltration in the first place, through network segmentation, strict access controls, and minimizing how much sensitive data is stored or reachable in the first place, matters just as much as recovery planning.

What This Means For You

Whether you're managing IT for a small business or simply protecting your own accounts, the lesson from this data is the same: assume that any breach involving your information could result in ongoing exposure, not a single incident. If a company you interact with discloses a ransomware attack, treat it as an open-ended risk. Reused passwords, old account credentials, and personal details tied to that breach can resurface in credential-stuffing attempts or follow-on scams long after the headlines fade.

For organizations, the takeaway is to treat data minimization and network segmentation as core ransomware defenses, not afterthoughts. Limiting what sensitive data is accessible from any single compromised point reduces how much attackers can steal even if they get in.

Actionable Takeaways

• Use unique passwords for every account and update them if you're notified of a breach involving your data, even months later.
• Enable multi-factor authentication wherever possible to blunt the value of stolen credentials.
• If you run a business, audit what sensitive data is stored and who can access it; less exposed data means less leverage for attackers.
• Don't assume a ransomware incident is over once a ransom is paid or systems are restored. Monitor for signs of leaked data or renewed extortion attempts.
• Segment networks so a single compromised device or account can't expose your entire data environment.

Ransomware's biggest advantage isn't the encryption that grabs headlines. It's the data theft that happens quietly beforehand and keeps generating value for attackers long after the initial crisis appears resolved.