Double-extortion ransomware is an attack where criminals both encrypt your files and steal (exfiltrate) your data. Triple-extortion simply adds a third layer of pressure such as a Distributed Denial-of-Service (DDoS) attack or harassment to your clients or staff. It’s simply another way to force your hand.
A February 2025 analysis found that 96% of ransomware attacks now include data exfiltration, so multi-factor ransomware attacks are now the standard.
That’s important for one big reason: It means even perfect backups won’t solve the problem of your data being stolen. We’ll explain the layers of both attack types, what to do following the attack, and how to navigate the disaster recovery process.
How Different Ransomware Models Work
To understand double and triple extortion, it helps to compare the models:
Standard (Single) Ransomware
Malware encrypts your files, making them unusable. You’re then presented with a ransom note demanding payment (usually in cryptocurrency) in exchange for a decryption key.
In this model, the solution was simple: if you had good, offline backups, you could wipe the infected systems, restore your data, and ignore the ransom. Unfortunately, the sheer profitability of ransomware has led bad actors to more sophisticated methods.
Double-Extortion Ransomware
Double-extortion ransomware has two distinct stages. Before any files are encrypted, the attackers identify sensitive data (financial records, customer lists, intellectual property), and copy it to their own servers.
After the data is stolen, the attackers deploy the ransomware, which encrypts your files and delivers the ransom note.
The two degrees of extortion:
- Pay for the decryption key to unlock your files.
- Pay that same fee (or an additional fee) to guarantee they will delete the stolen data and not leak it publicly or sell it on the dark web.
Even if you restore from backups, you still face a public data breach.
Triple-Extortion Ransomware
Triple-extortion adds a third layer of operational pressure. Common “third-layer” tactics include:
- Distributed Denial-of-Service (DDoS) Attacks: The attackers use a botnet to flood your website, servers, or network with junk traffic, knocking you completely offline. Even if you’re trying to restore, your public-facing operations are paralyzed.
- Direct Harassment: Attackers contact your customers, suppliers, partners, or even regulators directly. They inform them of the breach, often exaggerating the severity or leaking small samples of their data to destroy trust in your brand.
- Targeted Internal Pressure: Attackers may email or call high-level executives, employees, or shareholders directly to pressure them to pay.
The goal is to make the situation so chaotic and damaging to your reputation that paying the ransom seems like the fastest solution. Unfortunately, about 25% of victims who pay ransoms are unable to restore their data — and in many cases, paying for ransomware is illegal.
Ransomware Action Plan: First 24 Hours
If you discover a ransom note or suspect an attack is in progress, what you do in the first hour is critical.
- Isolate Everything: Disconnect the infected systems from the network immediately. Unplug ethernet cables and disable Wi-Fi on all suspicious devices. This includes servers, workstations, and network-attached storage. Your top priority is containment to stop the malware from spreading.
- Secure Your Backups: Verify the status of your backups. If they are online and connected to the network, disconnect them now to protect them from being encrypted. Offline (air-gapped) and immutable (read-only) backups are your best defense here.
- Don’t Wipe or Pay (Yet): Resist the urge to immediately wipe drives. Wiping the drives can destroy the encrypted data that might be recoverable. Do not pay the ransom.
- Document the Attack: Start a log of everything you find. Take photos of the ransom note (do not click any links in it). Note the time you discovered the attack, the systems affected, and the steps you’re taking.
- Report It: Contact our ransomware experts. It’s also advisable to contact law enforcement (in the U.S., this is your local FBI field office or the Internet Crime Complaint Center (IC3)).
Expert Solutions for Ransomware Recovery
Double and triple-extortion attacks are designed to be overwhelming, but even highly sophisticated attacks can be resolved.
Datarecovery.com provides ransomware recovery, darkweb monitoring, and additional services to help your business restore operations — and maintain customer trust — following a malicious attack.
Speak with a ransomware expert to learn more. Submit a case online or call 1-800-237-4200 for a free consultation.
