Ransomware 2026 — Why Crews Stopped Encrypting and Just Steal Now

Last year, ransomware crews launched ~50% more attacks — and made ~8% less money. The lock stopped paying, so they stopped using it. In 2026, 94% of ransomware cases involve stealing your data, and only 68% even bother to encrypt it. Welcome to the exfiltration era, where your backups don't save you.
What you'll hear:
• The shift to encryptionless extortion — steal and threaten to leak, instead of encrypt
• The numbers — payments down ~8% ($820M) as attacks hit records; why the "% who pay" figure (20/28/48%) depends on who's counting
• The twist — exfiltration is dominant but NOT a guaranteed payday; victims increasingly call the bluff (~2.5% on one campaign)
• The 2026 landscape — post-LockBit reshuffle: Akira + Qilin lead, Clop goes exfil-only, help-desk crews launch their own RaaS
• The AI angle — one operator + Claude Code = a 17-org extortion spree; time-to-exploit collapsed 700 days → 44
• Defense in an exfil-first world — egress/DLP, segmentation, phishing-resistant MFA + OAuth governance, immutable backups
• Security+ IR framing — a confirmed data theft is a reportable breach, encrypted or not
Sources: Coveware Q4 2025 · Chainalysis 2026 · Sophos · Verizon DBIR 2025 · Symantec · Anthropic (Claude Code extortion case).
— Andrés Sarmiento
#ransomware #cybersecurity #infosec #SecurityPlus #incidentresponse #TechUpdates