Leak-and-extort is an extortion tactic in which attackers steal sensitive files and threaten to publish them unless a payment is made. Unlike encryption-led ransomware, the main leverage is confidentiality loss: the victim may still have working systems, but faces exposure of private records, legal documents, customer data, or internal communications.
This model matters because backups alone do not stop it. Attackers often exfiltrate data, prove access with samples, and use countdowns or leak sites to pressure the victim. Defenders respond by limiting data access, segmenting sensitive repositories, monitoring unusual outbound transfers, and preserving evidence for incident response. Plans should also cover legal review, communications, and the possibility that a leak threat is real even if no encryptor is present.