thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

Double Extortion

A ransomware tactic that both encrypts data and threatens to leak stolen copies unless a ransom is paid.

Definition

Attackers exfiltrate sensitive data before encryption, then threaten publication on a leak site, which pressures victims even if they can restore from backup. Triple extortion adds DDoS attacks or contacting the victim's customers. Double extortion turns a ransomware event into a data breach with notification obligations.

Example

A gang posts a sample of stolen HR files on its leak site to pressure a company that restored from backups.

Exam tip

Backups do not mitigate the leak threat; DLP, egress monitoring and encryption at rest matter.

Related terms