These days, hackers are no longer just encrypting your data and demanding a ransom for its return. In a double extortion attack, cybercriminals threaten to leak and sell data on the dark web. This practice has now evolved into triple and multi extortion, as ransomware gangs seek out new ways of pressurizing their victims.
Keep reading to learn how double, triple, and multiple extortion attacks work, and what you can do to protect your organization.
What Is Double Extortion Ransomware, and Why Is It On the Rise?
Double extortion is a cyberattack strategy where hackers combine data encryption and data exfiltration. In other words, they encrypt your data and then threaten to release it publicly.
This tactic puts more pressure on victims to pay the ransom, as they face the loss of data, reputation damage, and legal consequences. And backups won’t help, because restoring the files won’t stop the leak.
This kind of attack has become the new normal, as it gives hackers much more leverage. 87.6% of all ransomware attacks now involve extortion, a significant jump from 48% in 2022.
According to various industry leaders, the shift stems from companies getting better at recovery.
“When organizations started maintaining recoverable backups, the pure encryption model stopped working reliably,” explains Omair Manzoor, Founder and CEO of security firm ioSENTRIX. “Ransomware groups adapted by exfiltrating data before encrypting it, creating a second leverage point that backups cannot solve.”
Rere Ayodele, a Cybersecurity Professional and Founder of Vektrl Academy, has a similar view. “Double extortion has become the standard ransomware model. Encrypted files stopped being enough leverage once companies invested in immutable backups, so they added data theft as the primary pressure point threatening to publish stolen files on leak sites regardless of recovery status.”
Rere has also seen the consequences firsthand: “I’ve sat on incident response calls where systems were fully restored within hours yet the real problem began days later when the attacker’s countdown timer appeared on their leak site.”
Example of a Double Extortion Ransomware Attack
Coca-Cola
In July 2026, Coca-Cola disclosed in an SEC filing that a ransomware attack had struck its dairy subsidiary Fairlife, disrupting production across all four of its US manufacturing facilities. Days later, a ransomware group claimed responsibility, listing Fairlife on its dark web leak site and claiming it had encrypted the company’s systems and stolen a terabyte of confidential data. The group threatened to publish the files unless Coca-Cola entered negotiations.
What Is Triple Extortion Ransomware?
Triple extortion adds a third layer on top of encryption and data theft: a distributed denial of service (DDoS) attack that knocks the victim’s systems offline entirely, compounding the pressure to pay.
This tactic is used selectively, mostly against organizations that can’t afford any downtime. According to Omair, “Healthcare organizations, financial services platforms, and e-commerce companies are particularly vulnerable because the DDoS creates immediate revenue loss and public-facing disruption that increases pressure to pay quickly.”
Example of a Triple Extortion Attack
City Government of Durant, Oklahoma
In June 2025, a ransomware gang targeted the city government of Durant, Oklahoma, USA, stealing over 800 GB of sensitive data. The group demanded ransom within 48 hours, threatening to sell or leak stolen passport details, addresses, and phone numbers if the city refused to pay.
In addition to the data breach, city services, including digital payments, were disrupted. The attack combined data theft, public pressure, and service outages, making it a clear example of triple extortion in action.
Multi Extortion Ransomware
In the most aggressive cases, attackers add a fourth layer: going directly after the victim’s customers, partners, patients, or regulators rather than confining the pressure to the organization itself.
It can get startlingly personal. Omair describes cases where ransomware groups have sent personalized emails to every patient in a stolen medical database, informing them their records would be published unless the healthcare provider paid.
“The strategy is to create pressure from every possible direction, internal, external, regulatory, and reputational,” explains Omair, “so that paying the ransom appears to be the least expensive option regardless of whether the victim has functioning backups.”
How a Multiple Extortion Attack Unfolds
Ransomware groups increasingly treat these tactics as escalating stages rather than fixed categories, adding pressure in sequence until the victim pays.
The data backs up why they bother: success rates climb sharply with each additional layer. Encryption-only attacks succeed around 28% of the time. Add data theft and the threat to leak it, and the success rate rises to 56%. Add a DDoS attack on top of that, and it climbs to 78%, according to a recent report.
A typical escalation looks like this:
Single Extortion: You realize your data has been encrypted. The hackers send you a note offering to sell you a decryption key to recover your data.
Double Extortion: You refuse to pay the ransom, so the hackers threaten to sell your data on the dark web.
Triple Extortion: Still not paying up? The hackers decide to hit your website with a DDoS attack, slowing or stopping your online operations.
Quadruple Extortion and Beyond: The hackers threaten to tell your customers, suppliers, and other partners about the breach. They might even start to threaten and demand ransoms from them, too.
Combining extortion techniques enables ransomware criminals to maximize their leverage and profits. Each layer adds another dimension of pressure on the victim.
This combined strategy has another advantage for cybercriminals: the attack can’t be solved with backups and decryption tools. Restoring your data is one thing, but the impact of a leak can be devastating.
How to Protect Against Double-Extortion Ransomware Attacks
With double-extortion ransomware on the rise, it’s clear businesses need to up their defense. Traditional security measures, like backups, won’t prevent cybercriminals from selling your confidential data. Here are some essential best practices to help you safeguard your business against these evolving threats:
- Go Beyond Backups with Storage-Level Protection
Backups help you recover data, but they can’t stop attackers from stealing it. ProLion’s DataDefense detects the early signs of ransomware and acts immediately, blocking the attacker at the storage level and alerting your IT team in real time. By stopping attacks before encryption or exfiltration can occur, DataDefense adds a critical layer of protection that backups and traditional tools can’t provide.
- Foster Cybersecurity Awareness and Training
The human element is often the weakest link in cybersecurity. Regularly educating your employees about recognizing phishing attempts, secure password practices, and the dangers of sharing sensitive information online is crucial.
- Ensure Timely Software Updates and Patch Management
Hackers exploit vulnerabilities in outdated software to initiate their attacks. Maintaining an up-to-date IT environment by regularly updating all software and applying security patches promptly is key to shutting down these entry points.
- Embrace a Zero Trust Security Framework
The zero trust model operates on the principle of “never trust, always verify.” Do not automatically trust any request for access, even if it comes from within your network. Verify every request to minimize the attack surface and protect sensitive data.
- Craft an Incident Response Plan
Having a clear, actionable incident response plan ensures you can act swiftly and effectively in the event of an attack. This plan should outline steps for isolating the threat, communicating with all stakeholders, and restoring systems with minimal operational disruption.
ProLion: Your Defense Against Multi-Extortion Ransomware
As ransomware evolves from encryption-only attacks to complex, multi-layered extortion campaigns, it’s more important than ever to close the gaps in your defense.
ProLion gives you real-time protection at the storage level, stopping threats before they spread. Talk to a ProLion cybersecurity expert today or download our free whitepaper to explore advanced strategies for staying ahead of ransomware.
