The note on the screen says your files are encrypted. What it usually doesn't say is that copies left the building hours or days earlier. Double extortion — encryption plus theft — is the default playbook for ransomware crews, and the second half of that threat is the part most recovery plans still ignore.
Paying can change the first half. It does nothing reliable about the second.
The order of operations has flipped
Older ransomware was mostly a smash-and-grab: encrypt, drop a note, wait for a wallet transfer. Today the intrusion usually looks like a quiet burglary that turns loud at the end. A typical sequence runs through initial access from a phishing attachment, an unpatched edge device or credentials bought from an initial access broker; then discovery of the network; privilege escalation; credential dumping from memory; lateral movement into file servers and backup infrastructure; staging of documents into archives; exfiltration; and only then encryption.
Some crews skip the encryption entirely. If they already hold payroll files, contracts and patient records, there's no need to lock anything — a threat to publish is cheaper than a ransomware binary and draws less attention from endpoint tools.
That ordering matters for defenders. By the time the note appears, the theft phase is finished. Anything you detect afterwards is archaeology, not prevention.
Why a deletion promise is worth almost nothing
Groups often offer "proof of deletion" — a screenshot, a screen recording, a message from a support channel. All of it is trivially fabricated, and none of it is verifiable by you. You cannot audit infrastructure you don't control, and the people running it are, by definition, not bound by an agreement you can enforce.
There's a structural reason too. Most operations work through affiliates: one person gains access, another moves through the network, another handles negotiations. A copy taken at any stage can be kept, sold or stored independently of whatever the negotiator promises. Data stolen in a breach is a durable asset; it can resurface months later in a second sale, or be handed to a different crew that has no relationship with the one you paid.
Payment also brings its own risks. Sanctions rules can make a transfer to certain actors or regions unlawful, and insurers and regulators increasingly ask hard questions about how the decision was made. Treat any negotiation as a legal and commercial decision, not a technical one, and involve counsel and your insurer before engaging.
Signals that data is already leaving
Exfiltration is rarely invisible. It's quieter than encryption, but it leaves a shape. Worth alerting on:
- Sustained outbound uploads well above a host's normal baseline, especially to cloud storage, VPS providers or file-sharing services nobody in the company uses.
- Archive creation outside normal work. Large ZIP, 7-Zip or RAR jobs, split archives, or password-protected output spawned by a script host, a database service or a remote management agent.
- Bulk reads from file shares and document stores — hundreds of files touched or copied in a short window by an account whose job never involves that volume.
- Cloud API abuse. Mass downloads from SharePoint, Google Workspace or object storage, new OAuth grants, unfamiliar user agents, logins from new locations for service accounts.
- New remote access tooling installed on endpoints without a ticket, particularly legitimate tools repurposed for staging and tunnelling.
- Log gaps. Audit settings turned off, agents stopped, or retention windows that vanish right when they'd be useful.
One signal alone is noise. Three in the same hour on the same subnet is a story.
Making egress visible in practice
You can't spot an anomaly without a baseline. Capture normal egress volume per host and per subnet over weeks, then alert on rate and rarity together: how much is leaving, and how unusual is the destination. Flow records, DNS logs and proxy logs are the cheapest sources; TLS inspection can help where it's lawful, clearly disclosed and proportionate.
Two controls pay off faster than anything else. First, restrict outbound access from server and database subnets to a short allowlist — most stolen data never should have had a route out. Second, ship logs off-host to storage the attacker can't rewrite, with retention long enough to reconstruct a breach that started weeks before it was noticed.
Then hunt, don't just wait. Schedule recurring queries for archive utilities, known exfiltration tool names and user agents, and spikes in outbound connection counts. Attackers often exfiltrate over the same channels they used for command and control, so tune for volume and destination novelty, not only for signatures.
Recovery plans should assume the data is gone
If your incident response plan was written for encryption, update the premise: assume every sensitive record the attacker could reach has already been copied. Then work through it:
- Isolate, don't power off. Cutting network access preserves memory, which may hold keys or evidence. Pulling the plug destroys it.
- Preserve evidence before restoring. Wiping and rebuilding feels productive but can erase the only record of what was taken.
- Rotate identity, not just passwords. Revoke active sessions and refresh tokens, reset service account credentials, remove unknown OAuth applications and rotate keys.
- Restore from immutable or offline backups — and test that restore path on a schedule, not for the first time during an incident.
- Run the notification analysis with counsel: who has to be told, within what window, and in what wording. Obligations vary by jurisdiction and sector.
- Prepare the outside conversation. Customers, partners and staff will ask whether their data was taken. Have answers ready before the first journalist calls.
Decide now, while it's calm
Who has authority to approve a payment discussion? Who calls the insurer, the lawyers and law enforcement? Who speaks publicly? Those decisions are impossible to make well at two in the morning with a countdown timer on screen. Write them down, name the people, and rehearse the scenario where the opening line is "our data was stolen" rather than "our files are encrypted."
Start with egress, not with the ransom note
Four moves you can make this quarter. Baseline outbound traffic for your ten most sensitive hosts. Ship logs off-host with retention measured in months, not days. Alert on archive tools, cloud sync clients and unusual destination countries. And run one tabletop exercise whose premise is theft without encryption, so your team practices the harder, likelier version of the incident.
Backups still matter — they decide whether you recover. Exfiltration detection decides whether you recover quietly. In double extortion, the second question is the one that ends up on the front page.
Photo: tookapic / Pixabay
