What is double extortion ransomware?

An attack where the criminals steal data before encrypting systems, then threaten to publish or sell the data if a ransom is not paid, on top of demanding payment for a decryptor.

Do I still need backups?

Yes. Backups are essential for operational recovery. They just do not address the data theft side of a modern ransomware incident.

Do we have to notify the ICO if only files are encrypted?

If personal data has been accessed, taken or made inaccessible in a way that risks people's rights, the ICO expects notification within 72 hours. Encryption alone can qualify. Take legal advice on your specific incident.

Does Cyber Essentials cover data breach response?

No. Cyber Essentials covers the technical baseline. Cyber Assurance and ISO 27001 cover incident response, data governance and supplier assurance more explicitly.

Ransomware and Double Extortion: Why Backups Are Not Enough

Ransomware is not just about encryption anymore

The old ransomware playbook was simple: encrypt files, demand payment, hand over a decryptor. The current playbook is different. Attackers exfiltrate sensitive data first, then encrypt, then threaten to publish the data on leak sites if the ransom is not paid. That is double extortion, and in some cases triple extortion when customers or regulators are contacted directly.

Why backups alone do not solve this

Restoring from backup does not un-publish stolen data.
Regulatory obligations (UK GDPR, ICO reporting) trigger on unauthorised access, not on file encryption.
Client contracts often require notification of any confirmed data breach.
Reputational damage from a leak site listing is independent of whether you paid or recovered.

What actually reduces double-extortion risk

Least privilege. The account that gets compromised should not be able to read every folder in the business.
MFA everywhere. Especially on cloud storage, email and admin consoles. See MFA requirements for 2026.
Data minimisation. Data you no longer hold cannot be stolen. Delete old client files, archives and stale mailboxes.
Egress monitoring. Unusual outbound data volumes are often the first signal of exfiltration.
Supplier access control. Third parties with standing access are a common lateral movement path.
Incident readiness. Know who calls the ICO, who calls the insurer, who calls clients and in what order.

Where Cyber Essentials fits

Cyber Essentials establishes the technical baseline: firewalls, secure configuration, patching, access control and malware protection. It closes the initial entry point that most ransomware still uses. It does not, on its own, cover data governance, incident response or supplier assurance – that is where Cyber Assurance takes over.

A short readiness prompt

If our production data was leaked publicly tomorrow, what would we tell clients on day one?
Who has read access to our most sensitive folders? When did we last check?
Do we retain data we no longer need? Where?
Do our suppliers have access we could revoke tomorrow if needed?

If any of those questions cause an uncomfortable pause, the fix is not another backup product.