Data-only extortion grows as ransomware gangs seek better profits

https://www.cybersecuritydive.com/news/ransomware-extortion-bec-arctic-wolf/812321/

Publish Date: 2026-02-17 11:18:00

Source Domain: www.cybersecuritydive.com

Listen to the article
4 min

This audio is auto-generated. Please let us know if you have feedback.

Dive Brief:

Data-only extortion attacks surged elevenfold over the past year, according to a report that the security firm Arctic Wolf released on Tuesday, illustrating how ransomware gangs are capitalizing on businesses’ fears of reputational damage.
In 22% of cases that Arctic Wolf responded to between November 2024 and November 2025, hackers only threatened to expose stolen data, rather than to leave it encrypted — a significant increase from the prior period, when only 2% of cases unfolded that way.
Arctic Wolf’s report also detailed hackers’ most common intrusion techniques, offering a warning to businesses about which of their systems could be the most vulnerable.

Dive Insight:

The increase in data-only ransomware attacks — a trend that other firms have also reported — reflects a change in hackers’ motivations, according to Arctic Wolf. “It now appears that some threat actors … have begun abandoning encryption altogether to focus purely on data exfiltration and extortion in hopes of better net returns,” the company said.

Ransomware accounted for 44% of Arctic Wolf’s incident-response engagements during the period covered in the report. The manufacturing sector bore the brunt of the attacks, followed by law firms, schools, financial institutions and health-care organizations.

Ransomware gangs have increasingly adopted affiliate models to generate more revenue, reduce expenses and “attract and retain a broader pool of cybercriminals,” according to Arctic Wolf. The result, the company said, was “a more competitive and interconnected ecosystem,” with hackers moving seamlessly between groups and the brand names of individual gangs mattering less.

The…

Source