What is data theft extortion and how does it differ from traditional ransomware?

In data theft extortion, attackers steal data and threaten to publish or sell it unless paid, without locking any files. Traditional ransomware encrypts files and demands payment for the decryption key.

Why don't backups solve the problem anymore?

Backups protect availability but not confidentiality, so restoring systems does nothing to remove the copy of stolen data from attackers' hands. The ransom note in these cases is built around exposure rather than downtime.

Why are small businesses hit hardest by this trend?

Common factors include fewer dedicated security staff, flat networks with shared access, and pressure to pay quickly. Data theft extortion also lowers attackers' effort since skipping encryption means fewer steps and less noise.

What defenses can limit what attackers are able to steal?

Practical steps include knowing and limiting what data you store, restricting access to only what each job requires, using multi-factor authentication, segmenting your network, and encrypting sensitive data at rest.

Ransomware Up Nearly 50%: Data Theft Hits Small Firms

Ransomware is reportedly up nearly 50%, and small businesses are absorbing most of the damage. What makes the trend harder to manage is a change in tactics. Ransomware data theft extortion small business cases increasingly involve attackers who never lock a single file. They steal the data, then threaten to publish or sell it unless they get paid.

The source article cites NordLayer in describing the shift: more extortion groups skip encryption and simply steal data, then threaten the victim. The full text available to us is brief, so this post sticks to those points and to widely understood security practice rather than adding figures we cannot verify.

Why backups no longer stop extortion

The classic ransomware attack locked your files and sold you the key. Good backups were the answer: restore the systems and move on. That advice still matters, but it solves only half of the modern problem.

When attackers steal data instead of encrypting it, nothing is broken on your end. Your systems may run normally. The leverage comes from what the criminals now hold: customer records, employee information, contracts, financial details. Restoring from a backup does nothing to take that copy out of their hands.

That is why the ransom note in these cases is built around exposure rather than downtime. The threat is that your customers, partners, or regulators will learn what was taken. Backups protect availability. They do not protect confidentiality.

Why small businesses are bearing the brunt

The article describes small businesses as taking most of the increase. While we cannot independently break down the reasons from the source text, several common factors are well recognized in security circles:

Fewer dedicated security staff. Many small firms rely on one IT generalist or an outside provider.
Flat networks and shared access. In smaller environments, one compromised account can often reach a lot of data.
Pressure to pay quickly. A factory that cannot run, or a clinic that fears a leak, may feel it cannot afford a long recovery.

Data theft extortion also lowers the attackers' effort. Skipping encryption means fewer steps and less noise, which can make an intrusion harder to spot before the demand arrives.

Defenses that limit what thieves can take

If the goal is to reduce what can be stolen, the defensive focus shifts from recovery alone to control over data. Practical steps include:

Know what you store. Inventory customer, employee, and financial data, and delete what you no longer need. Data you do not hold cannot be leaked.
Restrict access. Give each person access only to what their job requires, and remove accounts when people leave.
Use multi-factor authentication. Stolen passwords are a common way in, and a second factor raises the bar.
Segment your network. Keep sensitive systems separate so one breach does not expose everything.
Encrypt sensitive data at rest. Stolen files that are properly encrypted are far less useful to the thief.
Monitor for unusual transfers. Large or odd outbound data movement can be an early warning sign.
Keep tested, offline backups anyway. Encryption attacks have not disappeared, and groups can combine both methods.
Prepare an incident plan. Decide in advance who to call, including legal counsel and your IT provider, before pressure hits.

For a look at how a large ransomware operation moves from entry to extortion, the LockBit 3.0 analysis covering 2,000 victims across 95 countries maps the full attack chain and shows where defenders can interrupt it.

Where a VPN fits and where it doesn't

A VPN can be a useful part of a small business setup, but it is not a ransomware cure. Its main value is protecting traffic between remote workers and company resources, especially on public or untrusted networks, and limiting how exposed internal services are to the open internet.

What a VPN does not do is stop phishing, fix unpatched software, or prevent an employee with valid credentials from being tricked into handing them over. If an attacker logs in with stolen credentials, a VPN may even give them a convenient path inside. It also does not encrypt the files sitting on your servers or watch for data leaving your network.

Think of a VPN as one layer among several. It works best alongside strong authentication, patching, access controls, and monitoring.

What This Means For You

If you run or work for a small business, assume that having backups is no longer enough. The question to ask is not only "Can we recover?" but also "What could someone steal, and what would happen if they published it?"

Small teams do not need enterprise budgets to improve their position. Reducing the amount of sensitive data you keep, tightening who can reach it, and turning on multi-factor authentication address the exact lever extortion groups pull. Treat any VPN as a supporting tool, not the plan itself.

Key takeaways

Ransomware is reportedly up nearly 50%, with small businesses hit hardest.
More groups steal data without encrypting it, so backups alone cannot resolve an extortion demand.
Limit exposure by minimizing stored data, restricting access, and encrypting what remains.
Use a VPN as one layer of defense, not a substitute for the rest.

This week, audit what data your business stores and who can access it. Then read how a major group operates in our LockBit 3.0 ransomware breakdown to see how these attacks unfold in practice and where your ransomware data theft extortion small business defenses should be strongest.