For years, ransomware followed a familiar script: attackers encrypted systems, disrupted operations and demanded payment for a decryption key.
Today, the playbook has changed.
As organisations have strengthened their backup and recovery capabilities, cyber criminals have increasingly shifted towards data extortion. Rather than simply locking systems, attackers steal data and use public "naming and shaming" tactics to pressure organisations into paying. Data leak sites, public disclosures and direct contact with customers have become common tools in the cyber criminal arsenal.
A recent example is the alleged ASOS breach, where attackers reportedly used the retailer's customer notification channel to send messages threatening to leak data unless the company engaged with them. The aim appeared to be not only to communicate with the organisation, but also to create public pressure by involving customers before the facts had been fully established.
