Ransomware without encryption is an extortion tactic where attackers do not lock files with malware. Instead, they steal data and use the threat of publication, resale, or disclosure to pressure the victim into paying. The organization may still be able to run its systems, which can make the attack look less disruptive than classic ransomware while still creating serious legal, financial, and reputational risk.
This matters because backups alone do not solve the problem. Backup, recovery time objective (RTO), and recovery point objective (RPO) still support service restoration, but defenders must also protect data access, detect exfiltration, and prepare for notification and incident-response decisions. In real attacks, this pattern often appears as “double extortion” without the encryption step: the attacker claims to have taken sensitive files and threatens to release them unless demands are met.