Extortionware is a criminal pressure tactic that uses threats of data release, service disruption, or both to force a victim to pay or comply. Unlike classic ransomware, the attacker’s leverage may come from stolen files, screenshots, credentials, or the mere claim of access, even if systems are not encrypted.
It matters because the damage is often psychological and operational as much as technical. A convincing extortion claim can trigger panic, customer concern, and urgent incident response before any breach is confirmed. Defenders respond by checking identity logs, remote-access activity, endpoint alerts, and outbound transfer patterns to verify whether data was actually taken. Strong backups, segmented networks, phishing-resistant MFA, and careful log retention reduce the attacker’s leverage and help organizations distinguish a real compromise from a bluff.