What is double extortion? Ransomware plus data theft, as filings describe it

Double extortion is a ransomware tactic in which attackers both encrypt a victim's systems and steal its data, then demand payment to restore access and to keep the stolen data from being published. It turns an availability incident into a data breach as well, which changes the disclosure and notification questions a company must answer.

How CISA describes it

The Cybersecurity and Infrastructure Security Agency (CISA) uses the term for encryption combined with data theft and a threat to release. Its advisory on the Play group gives the sequence: data is exfiltrated, systems are then encrypted, and victims who refuse to pay are threatened with publication on a leak site on the Tor network. CISA also notes that some actors skip encryption and use stolen data as their only lever.

How it reads in a filing

The label itself may never appear. Jewett-Cameron Trading's Item 1.05 report, signed on 21 October 2025, described a third party deploying encryption and monitoring software, the exfiltration of images of video meetings and computer screens, and a threat to publish the material unless paid. Every element of the tactic is there; the term is not. The company also said it had no evidence at that point that personal information of employees, customers, suppliers or vendors had been compromised, one of the facts that decide whether individual notice duties start. The record's Jewett-Cameron entry follows the case.

Why it matters to a CISO

Restoring from backups answers the encryption half and leaves the theft half open. Once data has left the network, notice duties under a state breach notification law, the HIPAA Breach Notification Rule or GDPR Article 33 may apply even if operations recover quickly. A payment decision also raises the sanctions questions covered under ransomware.

What it is not

It is not ransomware limited to encryption, and it is not pure data extortion, where nothing is encrypted. The difference matters on the page: encryption speaks to operations and cost, while theft speaks to who must be notified.

Where it appears on cisonews.net

The incident log includes filings that pair encryption with data theft, such as Sensata Technologies, and data-theft demands with no encryption described, such as iRhythm Holdings and Coinbase.