Re-extortion is a second pressure attempt aimed at ransomware victims after the initial intrusion. Instead of relying only on the original ransom demand, an attacker, accomplice, or fake recovery service may contact the victim again and use promises of file recovery, decryption, or data deletion to create new leverage. The message often sounds helpful, but the real goal is to keep the victim under pressure and push them toward payment or disclosure.
It matters because re-extortion exploits the period when defenders are most vulnerable: systems may be encrypted, backups uncertain, and executives under time pressure. In real attacks, it can appear as a “help desk” call, a recovery offer, or a claim that stolen data can be erased. Defenders should verify every outside contact, preserve evidence, avoid sharing incident details, and route all negotiation through incident response and legal teams. Treat unexpected recovery claims as a risk signal, not proof of assistance.