Out of the Crypt: The Evolving Cyber Extortion Economy

Cybercriminals are increasingly using data theft and extortion without encryption (ransomware, a type of malware that locks files until payment is made), shifting from the 90% encryption rates seen in 2021-2024 to just 78% in 2025. This change is driven by better backup systems, stricter regulations like GDPR's 72-hour reporting requirement, and the fact that data exposure alone now costs organizations an average of $5.08 million in fines and lawsuits. Threat actors are particularly targeting mid-sized firms in Professional Services, Healthcare, and Construction, focusing on valuable business data like financial records and bids.