Destructive control is the claimed ability to do more than steal data: an attacker says they can delete, alter, encrypt, or otherwise disrupt stored information. In practice, it means the attacker may have obtained write access, administrative privileges, or control of backup and recovery systems, allowing them to damage records instead of merely copying them.
This matters because destructive control raises the impact of an intrusion from confidentiality loss to business interruption and data integrity failure. In extortion cases, it is often used as leverage to force payment by threatening records, backups, or cloud resources. Defenders look for unusual privileged actions, mass deletes, storage policy changes, and tampering with recovery points. Strong access control, immutable backups, separated admin roles, and audited recovery procedures help limit the damage if an attacker gains control.