Ransomware 2026 — Why Crews Stopped Encrypting and Just Steal Now

Last year, ransomware crews launched ~50% more attacks — and made ~8% less money. The lock stopped paying, so they stopped using it. In 2026, 94% of ransomware cases involve stealing your data, and only 68% even bother to encrypt it. Welcome to the exfiltration era, where your backups don't save you. What you'll hear: • The shift to encryptionless extortion — steal and threaten to leak, instead of encrypt • The numbers — payments down ~8% ($820M) as attacks hit records; why the "% who pay" figure (20/28/48%) depends on who's counting • The twist — exfiltration is dominant but NOT a guaranteed payday; victims increasingly call the bluff (~2.5% on one campaign) • The 2026 landscape — post-LockBit reshuffle: Akira + Qilin lead, Clop goes exfil-only, help-desk crews launch their own RaaS • The AI angle — one operator + Claude Code = a 17-org extortion spree; time-to-exploit collapsed 700 days → 44 • Defense in an exfil-first world — egress/DLP, segmentation, phishing-resistant MFA + OAuth governance, immutable backups • Security+ IR framing — a confirmed data theft is a reportable breach, encrypted or not Sources: Coveware Q4 2025 · Chainalysis 2026 · Sophos · Verizon DBIR 2025 · Symantec · Anthropic (Claude Code extortion case). — Andrés Sarmiento #ransomware #cybersecurity #infosec #SecurityPlus #incidentresponse #TechUpdates