Ransomware and extortion are pressure tactics used by threat actors to force payment by disrupting systems, threatening to leak stolen data, or both. In classic ransomware, files or services are encrypted to stop normal operations. In pure extortion, attackers may skip encryption and rely on stolen data, public victim listings, or leak threats to increase leverage.
This matters because the business impact can include downtime, lost revenue, legal exposure, and reputational damage even when encryption never occurs. Defenders should treat public claim pages as signals, not proof, and quickly verify whether there is actual intrusion, data exfiltration, or operational impact. Good defenses include backups, segmentation, patching, least privilege, monitoring for exfiltration, and incident response plans that preserve continuity while evidence is validated.