A few years ago, a ransomware attack meant one thing: your files got encrypted, you couldn’t access them, and someone demanded payment to decrypt them. Horrible, obviously, but at least the threat was straightforward. Either you paid and hoped they kept their word, or you restored from backups and accepted the downtime.

That version of ransomware still exists, but it’s no longer the main threat model. The groups running the biggest operations in 2026 have added a second lever: before they encrypt anything, they steal a copy of your data. Then they threaten to publish it publicly — on leak sites accessible to anyone — unless you pay. Even if your backups are perfect and you can recover without paying for decryption, they can still damage you by releasing customer data, financial records, employee information, or whatever sensitive material they’ve found.

That’s double extortion, and it changes the calculus significantly for small businesses.

Why This Matters More Than the Encryption Bit

The original ransomware threat was fundamentally a business continuity problem. Good backups mostly solved it — painful recovery, but survivable.

Double extortion is a data breach, which triggers a completely different set of obligations. Under UK GDPR, if personal data belonging to customers, employees, or suppliers is exfiltrated, you have a legal obligation to notify the ICO within 72 hours of becoming aware of the breach. If the breach is likely to result in high risk to individuals — and having their personal data published on a criminal leak site almost certainly qualifies — you also have to notify the affected individuals directly.

Failing to report within 72 hours doesn’t guarantee a fine, but it does guarantee scrutiny. The ICO’s enforcement approach considers whether organisations followed proper breach procedures, and “we didn’t report because we hoped it would go away” is not a mitigating factor.

This is why the business decision about paying ransom is more complicated than it used to be. Even if you can recover your systems, refusing to pay doesn’t necessarily protect you from the reputational and regulatory consequences of stolen data being published. On the other hand, paying doesn’t guarantee they’ll delete the stolen data — and you’re funding criminal operations.

The NCSC’s advice is unambiguous: don’t pay. The FBI and CISA agree. Payment doesn’t guarantee data deletion, it marks you as willing to pay (making future attacks more likely), and it funds further criminal activity. That’s the right policy position. It doesn’t make the individual business decision easier.

How They Get In

Double extortion groups follow the same initial access paths as all ransomware. The most common in 2026 remain:

Phishing emails that deliver credential-stealing malware or direct employees to fake login pages. Exploited vulnerabilities in internet-facing systems — particularly remote desktop, VPN concentrators, and unpatched web applications. Compromised credentials bought or stolen from previous breaches, used to log into systems directly.

The data exfiltration step happens in the dwell period before encryption — typically days to weeks after initial access. By the time you notice the ransomware encryption event (usually because everything stops working), the data theft is already done. This is why prevention and early detection matter more than incident response for this threat.

Reducing Your Exposure

The steps that actually move the needle:

Multi-factor authentication everywhere. Compromised credentials are the most common initial access vector. MFA stops credential-based attacks cold. Enable it on email, VPN, remote desktop, cloud services, and any internet-accessible system. If you use Microsoft 365 or Google Workspace, conditional access policies that block legacy authentication protocols close a significant secondary gap.

Patch internet-facing systems fast. The window between a vulnerability being disclosed and ransomware groups actively exploiting it has shrunk to days in 2026. VPN appliances, firewalls, and remote desktop gateways are the highest priority. Subscribe to NCSC’s alerts or your vendor’s security mailing list.

Limit what’s accessible from the internet. Remote desktop (RDP) should never be exposed directly to the internet — it should require VPN first. Web applications that don’t need to be public-facing shouldn’t be.

Segment your network so that a compromised endpoint can’t access everything. This doesn’t require enterprise-grade infrastructure. Even basic separation between staff devices, server infrastructure, and backups reduces what attackers can reach from a single compromised machine.

Backups that can’t be reached from your network. If your backup storage is accessible from your main network (and especially if it uses the same credentials), ransomware will target it. Cloud backups with immutable storage — where backups can’t be modified or deleted once written — are the practical solution for most SMEs.

If It Happens

Don’t panic and don’t pay immediately. Call your cyber insurance provider if you have one — most have 24/7 incident response lines and will direct you to specialist help. If you don’t have insurance, contact Action Fraud (0300 123 2040) and consider engaging a specialist incident response firm.

Preserve everything. Don’t wipe and reinstall immediately — you’ll destroy the forensic evidence needed to understand what happened, what data was accessed, and when. Take images of affected systems before any recovery work begins.

Start the ICO 72-hour clock. If personal data was involved — and you should assume it was until you can confirm otherwise — you need to start the notification process. The ICO’s breach reporting portal is online, and reporting early (even without full information, which you’re unlikely to have in 72 hours) is better than late. You can update the report as you learn more.

The NCSC has a good free resource — their Small Business Guide to Cyber Security covers the basics, and their Cyber Incident Response (CIR) scheme lists approved specialist firms if you need external help. A Cyber Essentials certification, which the NCSC administers, also gives you a defensible baseline and is increasingly required by government contracts and some insurers.

It’s not a comfortable truth, but double extortion exists because it works. The combination of business disruption and data breach consequences creates pressure that purely operational ransomware doesn’t. The answer is the same as it’s always been — make it harder to get in, limit what they can access and steal if they do, and have a tested plan for when (not if) it happens.