Google Reports Ransomware Pivot to Data Theft as Extortion Profits Wane

Google’s latest cybersecurity intelligence report highlights a seismic shift in the ransomware landscape, marking what analysts describe as the end of the "encryption-first" era. According to the report, major ransomware syndicates are increasingly abandoning the technical complexity of file encryption in favor of a more streamlined and often more lucrative model: pure data theft and extortion. This pivot is not merely a tactical change but a strategic response to a maturing defensive environment where traditional ransom demands for decryption keys are yielding diminishing returns.

The primary driver behind this shift is the widespread adoption of robust, immutable backup solutions. For years, the core leverage of a ransomware attack was the victim’s inability to access their own data. By encrypting critical servers, attackers could effectively halt business operations, forcing a payment to restore functionality. However, as organizations have prioritized disaster recovery and offline backups, the "lock and key" model has lost its potency. When a company can restore its entire infrastructure from a backup in a matter of hours, the value of an attacker’s decryption tool drops to near zero. Google’s data suggests that this has led to a significant decline in the percentage of victims willing to pay for decryption, prompting cybercriminals to find a new form of leverage.

“

Google’s latest cybersecurity intelligence report highlights a seismic shift in the ransomware landscape, marking what analysts describe as the end of the "encryption-first" era.

That new leverage is the threat of public exposure and regulatory catastrophe. In an "exfiltration-only" attack, the threat actor skips the encryption phase entirely, focusing instead on moving laterally through the network to identify and steal the most sensitive data—intellectual property, employee records, and customer PII. The extortion then centers on the threat of leaking this data on public "shame sites" or selling it to the highest bidder on the dark web. For many organizations, the reputational damage and the subsequent fines from regulatory bodies like the GDPR or CCPA are far more terrifying than a temporary system outage.

This transition also offers several operational advantages for the attackers. Encryption is a "loud" activity; it consumes significant CPU resources and often triggers immediate alerts from Endpoint Detection and Response (EDR) tools. In contrast, data exfiltration can be performed slowly and quietly, allowing attackers to maintain persistence within a network for weeks or even months. Furthermore, by removing the need to develop and maintain complex encryption software—which is often prone to bugs that can render data unrecoverable even after payment—ransomware groups can reduce their technical overhead and focus on the "human" element of the heist: social engineering and negotiation.