TL;DR
- Data-only extortion, where attackers steal data and threaten to leak or sell it without encrypting anything, rose 11x in 2025, according to Arctic Wolf.
- Ransomware is still the most common incident type, so backups still matter. But backups can’t stop ongoing data theft, show what was stolen, or handle legal and insurance requirements.
- Incident response covers more than recovery, including containment, forensics, legal review, insurer coordination, and communication.
- Lean IT teams should find their response gaps before an incident and line up outside help, such as an incident response retainer, to fill them.
For years, a strong backup strategy was one of the best defenses against ransomware. If attackers encrypted critical systems, organizations with clean, tested backups had a path to restore operations without paying a ransom.
That remains true. But encryption is no longer the only way attackers create leverage.
According to Arctic Wolf’s 2026 Threat Report, data-only extortion incidents increased 11x year over year in 2025. Ransomware remained the most common type of incident Arctic Wolf responded to, but data-only cases rose from 2% to 22% of its incident-response engagements. Data-only extortion is when attackers steal sensitive data and threaten to leak or sell it, without encrypting any systems.
The data shows that attackers are adjusting their tactics around the recovery controls organizations have put in place. That doesn’t make investing in backups any less valuable, but it creates a more complicated incident than many backup strategies were designed to handle. Getting systems back online may still be critical, but it may no longer be the point when the hard part is over.
For lean IT teams, that changes the question from “Can we recover?” to “What happens after we do?”
So let’s look at why these data extortion incidents are on the rise, and what helps IT teams prevent and respond to them.
Is Data Extortion Replacing Ransomware?
Not yet. Ransomware is still the most common incident type, but attackers are increasingly stealing data instead of, or in addition to, encrypting it. In Arctic Wolf’s 2025 incident response work, ransomware was the single largest category, accounting for 44% of cases, followed by business email compromise at 26%. IT teams can’t afford to deprioritize those problems, and the investments organizations have made in backup and recovery are still paying off. Reliable, well-protected backups remain critical when an attack disrupts systems or encrypts data.
What is changing is how attackers try to turn access into leverage.
Data theft is now a routine part of the threat landscape. For one report analyzing data threats in Europe in 2025, more than two-thirds of recorded intrusions resulted in data breaches involving information leaked or advertised for sale on cybercriminal forums.
Encryption is still a major part of the threat landscape, but attackers have more ways to create pressure. Ransomware deployments accounted for 40% of financially motivated activity in 2025, while data breaches accounted for another 31%. ENISA, the EU’s cybersecurity agency, also noted that ransomware operators are increasingly combining encryption, data theft, and other extortion tactics.
And plenty of money still follows the changing landscape of security incidents. Ransomware groups received more than $820 million in payments in 2025, even as the percentage of victims willing to pay continued to fall. Claimed ransomware attacks rose 50% over the same period.
Of course, we know the security landscape is changing. But these numbers suggest that while security and IT teams’ investment in their current defense architecture is hugely important, companies still need to be ready to respond to new threats and new attacker tactics.
The key is to recognize that the incident you may have to manage now looks different from the one those defenses were originally built around.
Why Aren’t Backups Enough When Data Is Stolen?
Backups restore systems, but they can’t stop ongoing exfiltration, show you what was taken, or handle legal and insurance requirements. That’s why your incident response has to cover more than getting systems back online.
NIST’s most recent ransomware guidance makes a useful distinction between recovery and response: recovery restores affected systems and operations, while response includes containing the incident, analyzing what happened, mitigating further damage, and coordinating reporting and communication.
That distinction matters most when data has been stolen. NIST recommends executing the incident response plan immediately to stop ongoing exfiltration and limit further spread, while forensic work helps establish the attack’s nature and extent.
In practice, those jobs do not happen neatly one after another. The team may disable compromised accounts and isolate systems while investigators preserve evidence and trace what the attacker accessed. Recovery work may already be underway before anyone has a complete picture of the incident.
The technical response is only part of what the investigation must support. Legal counsel may need to determine whether notification requirements apply. The cyber insurer may have reporting requirements or approved response providers. Leadership needs reliable information about the incident’s scope before deciding what to do about customers, employees, or business operations.
For a small IT team, the practical problem is capacity. Someone still has to keep the business running while the investigation moves forward, insurance requirements are met, and legal questions are answered. If you don’t identify those resources ahead of time, the first hours of the incident can be spent finding the right people instead of responding.
How Can Lean IT Teams Prepare for a Data Extortion Incident?
For most lean IT teams, the goal is not to build every incident response capability in-house. It is to know which capabilities you already have, where the gaps are, and who will fill them when something happens.
That means pressure-testing more than the restore process. Here are some questions to answer:
- Can your team preserve the evidence investigators will need?
- Do you know which provider your cyber insurer will approve?
- Is legal counsel already identified?
- Can you still access response plans and contact information if core systems are unavailable?
- When an incident moves quickly, does everyone know who has the authority to isolate systems or bring in outside help?
Then, the results of your IR test show where a partner can help fill gaps that are difficult to maintain internally, from forensic investigation and containment to recovery and coordination with insurers or legal teams. Just as importantly, they can help prepare the organization for an incident before anyone is working under pressure.
What Is an Incident Response Retainer?
An incident response retainer gives you pre-arranged access to an outside response team, so help is already lined up before an incident starts. Arctic Wolf’s approach offers a useful example. Its Incident360 Retainer combines access to its incident response team with readiness work such as incident runbooks, tabletop exercises, response planning, and an off-network portal for critical response information.
If and when an incident occurs, Arctic Wolf can help IT and security organizations support containment, digital forensics, root-cause analysis, and business restoration in parallel. The company is also listed on more than 30 cyber insurance panels globally, which can simplify coordination when an insurer needs to be involved.
For smaller IT teams, a retainer like this can turn incident response from an emergency scramble into a process planned, tested, and staffed before the first call.
Want to learn more? VLCM can help you look beyond backup and recovery to the broader incident response plan: where your current capabilities are strong, where gaps remain, and what support should be in place before an incident happens. Whether that means improving internal processes or adding a partner such as Arctic Wolf, the goal is the same: ensure your team is ready for the incidents organizations face today.
