Ransomware Extortion: More Than Locked Files
Understand why recovery planning must address stolen data and business decisions as well as encrypted files and backups.
· Last updated
A backup can bring your files back, but it doesn't settle a ransomware incident on its own. Attackers may copy data before they lock it, then threaten to release it. Your plan needs to cover who makes decisions, who you call and what to do about information that may have been taken.
Key Takeaways
- Extortion can involve threatened disclosure as well as unavailable files.
- A usable backup does not resolve every consequence of an incident.
- Know who leads the response and where monitoring responsibilities end.
This guide was originally published on 2022-03-24. Its guidance was substantially updated on October 2, 2026.
A backup addresses only part of the problem
CISA’s ransomware guidance includes data protection, detection, response and recovery. It recommends protected backups and restoration testing. Those measures support recovery, but restoring a file does not determine whether someone else obtained a copy or whether an account remains exposed.
For your business, identify the information that would require particular care if affected. Record who would involve legal counsel, insurance contacts or specialist responders, without assuming a generic checklist can decide your obligations.
Write down the decision-makers
An incident plan should name the people who can authorize disruption, contact outside support and communicate with employees or customers. Include a way to coordinate if normal email or shared files are unavailable.
Distinguish the people observing security signals from those authorized to make broader business decisions. A tool, monitoring service and full incident response engagement do not necessarily have the same responsibilities or billing scope.
Practice a realistic scenario
Use a short discussion: a critical application is unavailable and an extortion message arrives. Ask who receives the report, what business work is affected and where the response plan is kept. Record the gaps instead of expecting employees to improvise technical containment steps.
For Cyber Shift, incident response is scoped and billed separately from monitoring. Discuss your plan, where one is in place, and the responsibilities of each provider before relying on an assumed response arrangement.
Talk through the next step
Support and SOC monitoring are available 24/7/365. Incident response is scoped and billed separately from monitoring. Book a 30-minute call with our North Canton team about your ransomware response plan.
Reference: official guidance.