Double extortion in breach notices: when ransomware attackers steal data and post it

What the pattern looks like in a notice

"Double extortion" is the label used here for a two-part ransomware sequence. First, the attack disrupts the victim's systems. Second, the attackers hold copies of the victim's data, and publication follows if no ransom is paid. Breach notices rarely use the phrase. They describe the steps one at a time, often spread across several documents published months apart.

Box Elder County, Utah, published both halves of the sequence in its own words. Its public update dated August 14, 2025, says the incident temporarily locked multiple county government systems. The same update says the county was told that morning that the intruders had obtained some county data.

The County's later letter to the New Hampshire Attorney General describes the ransom decision. It says the County refused to pay any ransom to have the data deleted, and it cites FBI guidance. The letter says the criminals then published some County data.

Read together, these passages show the full sequence: systems locked, data taken, a ransom refused, and data published.

Box Elder County: from detection to notice

The letter to the New Hampshire Attorney General is dated December 17, 2025. It gives August 3, 2025, as the date the County found ransomware. The letter says the investigation found the intruders had been inside the network on and off for about three months before that date. It also says the attackers took County data during that period, including public records.

The County's public updates show how little was known in the first weeks. As of August 14, 2025, the update said, the County could not yet say what information had been taken.

The letter says the County reviewed the data after the attackers posted it, to work out what information was involved and who was affected. The County says it finished that review on November 17, 2025, and found that personal information of New Hampshire residents was involved.

The order of events matters for anyone tracking a case like this. The posting of data comes before the review of who was affected. In this case, the County reviewed the posted data itself to decide who should get a notice.

What was taken and who was told

The letter to the New Hampshire Attorney General is narrow in scope. It covers two residents of that state, whose names and Social Security numbers it says were accessed and taken. The resident letter template does not list fixed data types. It leaves a placeholder that is filled in for each recipient.

The resident letter names the other bodies the County informed: the Utah Attorney General, the Utah Cyber Center, and all appropriate state regulators. The resident letter also says the notice was not held back for a law enforcement investigation.

A notice to one state attorney general covers only that state's residents. The New Hampshire letter does not give a total number of affected people across all states.

What the County says it changed and offers residents

The County lists five security steps it has taken or will take. These are new security tools to speed detection and response, endpoint monitoring, an enterprise-wide password reset, tighter limits on external network access, and an evaluation of further defenses.

For residents, the letter to the Attorney General describes a one-year complimentary IDX membership for credit monitoring and identity theft services. The enrollment instructions set the deadline to sign up.

The rest of the resident letter covers standard protections, such as free credit reports, fraud alerts and security freezes. Its account of the incident is the part that matters for the extortion sequence. It is short, and it states plainly that the County refused to pay and that data was then posted.

Advantest: a ransomware disclosure at an early stage

The Advantest Corporation announcement shows a disclosure made before any finding about data. The company says it detected unusual activity in its IT environment on February 15 (JST). The announcement is dated February 19, 2026. It says preliminary findings appear to indicate that an unauthorized third party may have accessed parts of the network and deployed ransomware.

The announcement does not say whether any data was taken. It also does not mention a ransom demand or any posting of data. Instead, it describes what Advantest will do if data turns out to be involved. It also says its contents may change as the investigation continues.

Box Elder County's first statement, issued in August 2025, was at a similarly early stage. The details about the data, the refused ransom and the posting came in later documents.

Reading notices for both halves of the pattern

Taken together, the two cases show how the extortion sequence appears across a series of documents rather than all at once. A first statement typically reports only the system disruption. Later updates may confirm that data left the network. A formal notice letter, sent after a review, may then describe the ransom decision and any publication of data.

For each victim's documents, four questions show whether both halves of the pattern are present:

• Did data leave the network?
• Was a ransom demanded, paid or refused?
• Was data published?
• When did the review of affected data end?

Box Elder County's documents answer all four. Advantest's announcement, at its stage, answers none of them about data and covers only the ransomware deployment.

Which ransomware groups does CISA say use double extortion?

Twelve of the eighteen #StopRansomware advisories that CISA lists on its official alerts page use the words double extortion for the group they describe. They run from CL0P in June 2023 to Gunra in August 2026. BianLian is the one that changed course: the advisory says the group began with double extortion, then moved to extortion by data theft alone, mostly from about January 2023 and entirely from about January 2024. For a breach notice that matters, because a theft-only attack can leave no encrypted system to report.

CISA advisory	Group	Date on the advisory	What the advisory says the group does
AA23-061A	BlackSuit (Royal)	Last revised 27 Aug 2024	Encrypts files and threatens to release the stolen data if the victim does not pay.
AA23-136A	BianLian	Last revised 20 Nov 2024	Used double extortion at first, then moved to theft-only extortion: mostly from about January 2023, exclusively from about January 2024.
AA23-158A	CL0P	Released 7 Jun 2023	Previously known for stealing and encrypting victim data, refusing to restore access and publishing the stolen data on a Tor site.
AA23-263A	Snatch	Released 20 Sep 2023	Steals data and threatens to post it on its extortion blog if the ransom goes unpaid.
AA23-319A	Rhysida	Last revised 30 Apr 2025	Demands payment to decrypt and threatens to publish the stolen data. CISA says the actors reportedly do this.
AA23-352A	Play	Last revised 4 Jun 2025	Encrypts systems after stealing data.
AA24-109A	Akira	Last revised 13 Nov 2025	Encrypts systems and threatens to leak what it took.
AA24-131A	Black Basta	Last revised 8 Nov 2024	Encrypts systems and steals data, after phishing or a known vulnerability.
AA24-242A	RansomHub	Released 29 Aug 2024	Affiliates encrypt systems and steal data to extort victims.
AA25-071A	Medusa	Last revised 18 Aug 2026	Developers and affiliates encrypt data and threaten to release it if no ransom is paid.
AA25-203A	Interlock	Released 22 Jul 2025	Encrypts systems after stealing data, so the victim pays both to decrypt and to stop a leak.
AA26-222A	Gunra	Released 10 Aug 2026	Encrypts data and threatens to publish it on a dedicated leak site.

The six advisories on the same list that do not use the term are LockBit 3.0 (AA23-075A), AvosLocker (AA23-284A), LockBit 3.0 affiliates exploiting Citrix Bleed (AA23-325A), ALPHV Blackcat (AA23-353A), Phobos (AA24-060A) and Ghost, also called Cring (AA25-050A). Leaving the label out is not a finding that no data was taken.

Method: on 13 November 2026 we read CISA's Official Alerts and Statements page for #StopRansomware and opened every advisory on it whose title begins #StopRansomware (18 of them, from 2023 to 2026). We kept the ones whose text contains double extortion or double-extortion. The date shown is the advisory's last revision where it has one, and its release date where it does not. The descriptions are our summaries of each advisory's own sentence.

How do older notices in the log answer the four questions?

Two older entries in the log show the questions at work.

Ascension's letter answers the first question. The health system says it detected unauthorized activity on its technology systems on May 8, 2024, the result of a ransomware attack. Its investigation found that a cybercriminal copied files holding patients' and staff members' personal information on May 7 and 8. The letter does not say whether a ransom was demanded or whether any data was posted.

The City of El Cerrito shows the order reversed: the leak-site listing was public before any letter. The Record reported on August 10, 2023 that the LockBit group had added the city to its leak site. The city told the outlet that its systems were fully operational and that it was not locked out of any devices or data. The city's letter, filed with California's attorney general, later answered the first question. It found unauthorized access to folders holding files with personal information between June 1 and June 7, 2023. It gives March 28, 2024 as the day the city finished locating addresses for the letters, which answers the fourth question. The letter does not mention a ransom.

Nephrology Associates, a medical practice in Connecticut, shows a ransomware notice with only the first half of the pattern. Its letter says a ransomware incident on September 8, 2026 involved unauthorized access to a server holding patient and employee information. It then answers the theft question in the negative: the investigation found no evidence that information was removed from the network. The practice still sent letters about the access. A notice like this one says ransomware without saying double extortion.