Backups solve the encryption problem but not the theft problem. In double extortion, attackers copy data before encrypting and threaten to publish it. CISA and the NCSC both describe this, so a plan that stops at backups leaves half the risk open.
What double extortion is
CISA's guide notes that attackers may steal data and threaten to release it as well as encrypting systems. The NCSC says attackers may copy data and threaten to leak it, and advises reducing the impact of data theft. OFAC's advisory also notes that in some cases attackers threaten to publicly disclose sensitive files.
What backups do and do not cover
- Encrypted servers: backups help, if tested and out of reach.
- Downtime: backups help partly, depending on restore speed.
- Stolen files being published: backups do not help.
- Notification duties to customers or regulators: backups do not help.
- Attacker still having access: backups do not help.
Reducing the impact of data theft
The NCSC points to guidance on data security and protecting bulk personal data. Practical measures follow from that:
- Know what you hold. If you cannot list sensitive data stores, you cannot assess a theft.
- Hold less. Delete data you no longer need.
- Encrypt at rest and control keys. Stolen encrypted data is only useful with the keys.
- Limit reach. Least privilege means one stolen account exposes less.
- Watch egress. CISA's hunting list includes abnormal outbound data on any port, tunnelling tools such as Chisel and Cloudflared, and transfer tools such as Rclone, Rsync, file storage services and FTP or SFTP.
Prepare the non-technical side
A leak threat creates decisions that backups never touch: who tells customers, who talks to regulators, who handles press and staff questions. The NCSC advises planning communications and legal reporting obligations ahead of time and keeping offline playbooks.
Do not forget the payment myth
OFAC and the NCSC both point out that paying brings no guarantee of recovery. Nothing in the sources reviewed promises that stolen data will be deleted after payment.
A practical first step
Build a one page data map: where sensitive data lives, who can read it, and how long you keep it. When a leak threat arrives, that page lets you scope what could have been taken in hours rather than weeks. It also feeds your notification analysis and your retention clean up.
Quick check
If we restore from backup, are we done?
No. If data was copied, you still face leak threats and possible notification duties, and you must still close the attacker's access.
How do we tell if data was taken?
Look for abnormal outbound transfers and use of transfer tools in logs, as CISA's hunting list suggests. Long log retention helps; CISA suggests at least a year where possible.
Sources
Last reviewed: 19 October 2026.
