RackTop Systems
Threat Brief

Extortion without encryption: the steal-and-leak business model

A growing share of extortion groups no longer bother encrypting anything. They steal files and threaten to publish them, a model that makes backups irrelevant and puts all the weight on stopping the theft itself.

RackTop Systems•June 30, 2026•2 min read

Key takeaways

  • Several major extortion operations have dropped ransomware payloads entirely in favor of data theft.
  • Steal-and-leak defeats recovery-centric defenses: there is nothing to restore.
  • The decisive control moves upstream: detecting and stopping bulk reads on production data.

For years, the ransomware economy ran on encryption: lock the systems, sell the key. Then defenders got better at recovery: immutable backups, isolated vaults, rehearsed restores. The criminals adapted. First came double extortion, stealing data before encrypting it. The next step was to drop the encryption altogether. Groups like World Leaks operate purely on theft: exfiltrate the files, name the victim on a leak site, and charge for silence.

From the attacker’s side, the logic is sound. Encryption is noisy, increasingly detected mid-run, and invites law-enforcement pressure. Reading files with a valid credential is quiet, and the leverage is just as strong: regulatory exposure, customer IP, employee identity documents. In some sectors it is stronger. A manufacturer can rebuild its servers in a week. The customer’s designs stay on the leak site.

What this breaks in the standard defense

Recovery-centric programs assume the harm is downtime. Steal-and-leak inverts that: there may be no downtime at all, and the first sign of trouble is your name on a leak site. Backups, vaults, and restore runbooks are all still necessary for the attacks that do encrypt. Here they contribute nothing.

The controls that matter are the ones that act while the theft is in progress. Behavioral detection on live file activity, so a session reading far outside its normal pattern is stopped mid-stream. Least-privilege access evaluated per operation, so one credential cannot reach everything. And an immutable audit trail, so if data does leave, you know precisely what left, which converts a worst-case disclosure into a bounded one.

The question to ask your storage

Steal-and-leak is, in the end, a storage workload: a long sequence of reads. The defining question for any file platform is whether it would notice. If the answer is that ten thousand reads by one account looks the same as one, the extortion model works. If the storage recognizes the pattern and terminates the session, it does not.

Frequently asked questions

Extortion without encryption is a data theft model in which the attacker copies files out of a victim environment, names the victim on a leak site, and charges for silence, without ever deploying a ransomware payload. Nothing is locked and nothing needs restoring, so the leverage rests entirely on disclosure: regulatory exposure, customer intellectual property, employee identity documents. Groups such as World Leaks operate on theft alone.
Skipping the payload makes the operation quieter while leaving the leverage intact. Encryption is noisy, increasingly detected mid-run, and it invites law-enforcement pressure, whereas reading files with a valid credential resembles ordinary work. In some sectors the theft-only version is the stronger threat: a manufacturer can rebuild its servers in a week, but the customer designs that were taken stay on the leak site.
There is nothing to restore, which is what makes the model work. Steal-and-leak leaves production data intact, so immutable backups, isolated vaults, and rehearsed restore runbooks contribute nothing to this outcome, even though they remain necessary for the attacks that do encrypt. What changes a steal-and-leak outcome is evidence and interruption: a per-operation record of which files a session actually read, and a control that stops the reading before the copy finishes.Cyberstorage explained
Storage can stop a bulk read in progress, but only if it judges file operations as they happen rather than logging them for review later. BrickStor SP evaluates each operation inline in the data path across SMB, NFS, S3, and Web Drive, weighs it against the normal behavior for that identity, and can terminate a hostile session in under a second. Access is decided per operation through attribute-based access control, so a single compromised credential does not reach everything.How Active Defense works

Go deeper

The Tata Electronics leak, analyzed →Cyberstorage vs. cyber vaulting →

More on data exfiltration

See all →
Back to the Data Defense Center

Could you prove what an attacker read?

Score your own file estate against the controls this incident defeated. Twelve questions, no sales contact, a report at the end.

Take the Cyber Recovery AssessmentSee How Active Defense Works
Data Theft Extortion: The Steal-and-Leak Ransomware Model | RackTop