Ransomware is a data theft business now. Most defences still guard the wrong door.

This article is part of our Opinions section, where we invite industry professionals to share their views on the most pressing technology questions of our time.

The encryption event gets the headlines and the incident response budget. The leak that already happened is where the leverage lives, and it usually walks out through tools your own admins trust.

For most of the last decade, we talked about ransomware as if the encryption was the crime. Files get scrambled, a note appears, you restore from backups, or you pay. That mental model shaped how we buy security, how we write incident response plans, and how we brief the board. It is also mostly wrong in 2026.

Modern ransomware is a theft operation first and an encryption event second. The lock on the door is theatre. The money was already made when your data left the building.

The numbers moved, and they point at the leak

The data on this is no longer subtle. Mandiant’s M-Trends research confirmed data theft in 77% of ransomware intrusions, up from 57% the year before. The Verizon Data Breach Investigations Report now folds encrypting ransomware and extortion-only attacks into a single category, a quiet admission that the theft is the business, and it found ransomware present in 44% of breaches, up from 32% the year before. Whichever number you trust, the story is the same. Stealing the data is now the point and encrypting it is a bonus round.

If you still think of ransomware as an availability problem, you are defending a version of the threat that retired years ago.

The encryption event is a decoy

Here is the part that should change how you spend. The theft is now the constant, and the encryption is optional. Coveware, which negotiates these cases for a living, confirmed data exfiltration in 94% of the incidents it handled in late 2025, with many campaigns prioritising data theft over locking systems at all. A whole class of attack now skips encryption and simply threatens to publish what was taken.

The logic is obvious once you say it out loud. Attackers can drop the loud, forensic, evidence-heavy step of encryption because they do not need it. The leak is enough. Why kick down the door on your way out when you already emptied the safe?

The problem is that encryption is the part our tools are tuned to see. It is loud. It changes thousands of files. It trips every behavioural alarm we built. Exfiltration is the opposite. It looks like a Tuesday.

Your own admin tools are the getaway car

The uncomfortable truth is that most data theft in a ransomware attack rides out on software your IT team installed on purpose. Attackers love living off the land, which is a polite way of saying they use your stuff against you.

The clearest example is rclone, a legitimate open-source utility that syncs files to more than seventy cloud providers. It is genuinely useful, which is exactly why it is dangerous. It is catalogued as a named technique in MITRE ATT&CK, and government advisories keep finding it at the scene of real attacks. In its Black Basta advisory, CISA notes that affiliates use rclone to exfiltrate data before encryption, and it names the same tool across its guidance on BianLian, LockBit and Conti.

To a content inspection engine, a clone transfer to a cloud bucket and a legitimate backup job look identical. That is the whole trick. When the getaway car is the same make and model as every other car in the lot, watching the traffic will not save you.

JADEPUFFER handed us the receipt

If you want a preview of where this goes, look at JADEPUFFER, which the Sysdig Threat Research Team documented in July 2026 as the first fully agentic ransomware operation, run end to end by an AI agent rather than a human crew.

The detail that matters for this argument is buried in the agent’s own logs. Before it destroyed the target databases, the agent noted that the high-value data was already staged to an external server. In other words, the tooling itself recorded that the theft was finished before the destructive payload ran. The encryption, or in this case the deletion, was the last step, not the first. By the time anything looked like a ransomware incident, the leverage was already sitting on someone else’s server.

That is the entire thesis in one campaign. The damage is done upstream of the moment we usually call the attack.

Why detection keeps arriving after the leak

Detection-first security has a timing problem it cannot fix. It works by watching for behaviour it recognises, then responding. Against exfiltration through trusted tools, there is often nothing recognisable to catch until the data is already gone and the note is on the screen. You cannot respond your way out of a theft that finished an hour ago.

This is not a knock on the analysts. It is a knock on the model. We keep buying faster ways to detect an event whose most valuable part happens quietly and legitimately, using approved software, over approved ports, to approved-looking destinations.

Control the exfiltration step, not just the encryption

So what actually changes the math? Moving the point of control earlier, to the tooling itself, before anything runs.

The strategy worth your attention is straightforward. Stop the dual-purpose transfer tools from executing in the first place, on the endpoints where they have no business running, and raise a distinct, high-priority incident when they try. This is not a content scan of what is leaving. It is a hard stop on the vehicle before it starts, tagged with the tool, the user, the domain, the host, and the MITRE technique so your team knows exactly what they are looking at.

The logic is simple. If the exfiltration step never completes, the leak never happens, and the extortion leverage never exists, even if every other control on the endpoint failed. You remove the crime by removing the getaway, not by chasing the car down the highway.

What to do before your next board update

You do not need to rip anything out to act on this. You need to reweight. A few concrete moves:

• Treat data theft, not encryption, as the primary ransomware event in your incident response plan and your board reporting. If your tabletop exercise ends at “we restored from backup,” it is testing the wrong disaster.
• Inventory the legitimate transfer and sync utilities in your environment, including rclone, and decide which endpoints should ever be allowed to run them. On most, the honest answer is none.
• Add a control that blocks unauthorised transfer tools before execution and alerts on the attempt, rather than relying only on inspecting traffic after it moves.
• Assume the attacker will use tools you already trust, and build your defences for that reality instead of the malware signature era.

The ransom note is not the beginning of your worst day. It is the receipt for a theft that already closed. The lock on your files was never the point. The copy of your data on someone else’s server is. Guard that door, and you take away the only leverage that still works.

Related articles

• The overlooked ransomware dependency is identity recovery
• Businesses need a new defensive formation against ransomware
• Chris Hosking, AI & Cloud Security Evangelist at SentinelOne: “Lots of security teams can’t see what’s going in or coming out of AI across their employees”