The Business Model Shift That Changes Everything
For most of the ransomware era’s history — roughly 2013 to 2023 — the attack model was straightforward: encrypt files, demand payment for the decryption key, rely on victims’ operational paralysis to create payment pressure. File encryption was both the weapon and the leverage mechanism. Incident response playbooks were written around this model: detect encryption activity, isolate affected systems, restore from backups, avoid paying.
That model is being abandoned by the most financially sophisticated ransomware groups. BlackFog’s Q1 2026 ransomware report documented 264 publicly disclosed attacks with 96% involving data exfiltration, a rate that has held steady from 2025. But the publicly disclosed figure is a fraction of actual activity — the 264 represent only cases where victims appeared on ransomware data leak sites.
Kaspersky’s 2026 ransomware analysis via Securelist confirms the directional shift: ransom payments fell to 28% of incidents in 2025, a figure that reflects both improved backup practices and the growing reality that encryption is increasingly unnecessary for extortion. Groups like ShinyHunters have built their entire business model around data theft and public-leak threats without deploying file encryption at all.
Why has encryption become optional? Three factors:
Backup resilience has improved. Enterprise backup practices matured significantly between 2020 and 2025. Organizations now maintain offline and air-gapped backups capable of restoring operations within hours rather than days. The operational pressure from encryption has weakened as backup quality improved — victims can often recover without paying. But no backup can un-expose data that has already been exfiltrated and published.
Encryption triggers detection. File encryption at scale creates distinctive noise in endpoint detection and response (EDR) platforms — rapid I/O, mass file modification events, shadow copy deletion attempts. Modern EDR tools catch many encryption attacks before significant damage occurs. Exfiltration, by contrast, looks like normal outbound network traffic and is far harder to detect in real time. Attackers naturally gravitate toward the approach that is harder to detect.
Public leaks create asymmetric pressure. Threatening to publish sensitive customer data, intellectual property, or executive communications creates legal, regulatory, and reputational consequences that many organizations find more threatening than operational disruption. GDPR and equivalent data protection regimes mean that a confirmed data breach triggers mandatory notification obligations, regulatory investigations, and potential fines regardless of whether the organization pays the ransom. The threat of public exposure is often sufficient leverage without encryption.
The Q1 2026 Threat Landscape in Numbers
Recorded Future Q1 2026 Ransomware Analysis tracked 2,122 organizations appearing on ransomware data leak sites — the second-highest Q1 on record. The top 10 groups accounted for 71% of all victims, reflecting market consolidation: the ransomware ecosystem is concentrating among fewer, more professional operators. Qilin led with 338 victims across the quarter — the most active group for the third consecutive quarter.
Average data stolen per incident reached 743GB, according to BlackFog’s data. At that volume, exfiltration is not a side operation — it is the primary operation. The average ransom deadline dropped to 7.7 days, creating compressed decision windows for incident response teams.
The sector distribution provides targeting context. Healthcare absorbed 72 attacks (27% of the BlackFog total) — a concentration that reflects healthcare’s combination of sensitive data, operational criticality, and historically weak cybersecurity investment. Government entities followed at 32 attacks (12%), with the technology sector at 28 attacks (11%).
Geographically, 61% of publicly disclosed victims were US-based — but this reflects primarily the reporting bias of English-language ransomware leak sites. The geographic reach of active campaigns is genuinely global, and BlackFog’s analysis of undisclosed incidents suggests the non-US proportion is significantly higher than publicly visible data implies.
Advertisement
How Enterprise Incident Response Must Change
The shift from encryption-first to exfiltration-first extortion requires specific changes to enterprise incident response programs. Three adjustments are non-negotiable.
1. Shift detection triggers from encryption signals to exfiltration signals
The canonical EDR detection rule for ransomware — high-frequency file modifications, shadow copy deletion, ransomware-note file creation — is a detection strategy optimized for 2020, not 2026. Modern exfiltration campaigns don’t trigger these rules because they don’t encrypt anything. Teams should add exfiltration-specific detection: data loss prevention (DLP) rules monitoring large outbound transfers, DNS tunneling detection, unusual file staging in temporary directories before scheduled exfiltration windows, and behavioral rules flagging access to multiple high-sensitivity data repositories within compressed timeframes. The average 743GB per incident has to transit the network — a behavioral baseline for outbound data transfer volume is the primary detection surface now available.
2. Redesign the backup-and-recovery strategy for data exposure, not just operational recovery
The prevailing enterprise advice on ransomware has been “maintain good backups.” That advice addresses operational recovery from encryption. It does not address extortion from data exposure. No backup strategy prevents the publication of data that has already been exfiltrated. Enterprises must implement data minimization policies — storing sensitive data only in systems where it is operationally necessary — and tiered data access controls that limit which accounts, systems, and roles can access high-sensitivity data repositories. A threat actor who compromises a service account with broad read permissions across the data estate can exfiltrate at scale regardless of backup quality. The defense has to move upstream to access control and data classification before exfiltration occurs.
3. Prepare for regulatory consequences regardless of payment decision
Kaspersky’s ransomware analysis notes that organizations increasingly treat ransomware incidents as regulatory events, not just operational ones. In any jurisdiction with mandatory breach notification — GDPR, CCPA, Algeria’s Law 18-07, or equivalent — the moment sensitive personal data is confirmed to have been exfiltrated, the clock starts on mandatory notification obligations. Paying the ransom does not reset that clock, does not remove the data from attacker control, and does not eliminate the notification obligation. Incident response playbooks must include a legal track running in parallel with the technical track from day one: identifying what data was accessed, assessing notification obligations, and engaging legal counsel before any payment discussion occurs.
The Structural Shift in Ransomware Economics
The 2026 ransomware landscape represents a professionalization and market consolidation that changes the risk profile for enterprises in ways that individual attack statistics don’t fully capture. The concentration of 71% of victims among the top 10 groups, combined with the emergence of The Gentlemen group — which reached the top three in one quarter through “controlled operations” — suggests that the ransomware market is entering a phase resembling professional services: reliable processes, consistent targeting criteria, predictable negotiation patterns.
This professionalization has a counterintuitive implication: it is easier to reason about and prepare for than the chaotic, fragmented threat landscape of 2019–2022. Groups with consistent behavior can be studied, their targeting criteria can be identified, and organizations can make informed assessments of their relative exposure. The relevant question for enterprise security leaders is not “will we be attacked” but “are we in the target profile of active groups, and if so, what specific controls address the exfiltration-first model they use.”
Frequently Asked Questions
Why does paying the ransom in a data-theft extortion attack not solve the problem?
In a pure data-theft extortion attack, the attacker retains a copy of the exfiltrated data regardless of payment. Unlike encryption attacks — where the attacker technically needs to provide a working decryption key to receive payment — exfiltration-based extortion is structurally irreversible: the data has already left the organization’s control. Payment may result in the attacker removing a specific leak site post, but it does not eliminate their copy, prevent future extortion with the same data, or release the organization from breach notification obligations triggered by the confirmed exfiltration event.
What is the most effective early detection signal for exfiltration-first ransomware?
Large-volume outbound transfers to non-business destinations are the most reliable signal available. A behavioral baseline for outbound data transfer volume — the typical volume and destination range for a given system over 30 days — makes statistical outliers detectable in near-real-time. The 743GB average per incident confirmed by BlackFog represents a transfer volume that should be impossible to miss with a properly configured DLP policy. Secondary signals include access to multiple high-sensitivity repositories within a compressed timeframe, file staging in temporary directories, and DNS queries to newly registered domains (a common characteristic of exfiltration infrastructure).
How do Qilin and ShinyHunters differ in their extortion approach?
Qilin, the most active group by victim count in Q1 2026, uses a traditional double-extortion model: deploy ransomware for operational disruption, simultaneously exfiltrate data for extortion leverage, then threaten both operational disruption and public data release. ShinyHunters, by contrast, has moved to a pure exfiltration model with no encryption component — data is exfiltrated, targets are contacted privately with a payment demand, and non-payment results in public release on leak sites. The ShinyHunters model requires no malware deployment visible to EDR, making it significantly harder to detect before exfiltration is complete.
—
Sources & Further Reading
🔗 Related Intelligence
The Gentlemen Ransomware Group’s 5x Surge: Q1 2026 Data and What ‘Elevated New Normal’ Means for Defenders
Ransomware Every 19 Seconds: The State of the Global Ransomware Crisis
ShinyHunters May 2026: SaaS Records Are the New Ransomware Target
Ransomware New Normal: 49% More Groups, 2,122 Q1 Victims — What Now?
