What is double extortion?¶

The practical answer¶

Double extortion combines disruption or encryption with a threat to publish, sell or misuse stolen data.

The key evidential caution¶

The dangerous assumption is that a double-extortion claim proves data was actually exfiltrated.

It does not.

An offender may:

Key points¶

• encrypt systems
• claim to have stolen data
• provide sample files
• threaten publication
• contact customers or partners
• increase pressure through deadlines or public posts

Investigators should separate:

• evidence of encryption
• evidence of collection
• evidence of transfer
• evidence of possession
• evidence of publication
• the offender’s claims

A sample file may support possession of that item.

It does not automatically prove possession of the wider dataset claimed.

Evidential limits¶

Likewise, exfiltration evidence may exist without proving that the same person or group performed the encryption.

Relevant evidence¶

Relevant evidence may include archive creation, outbound transfer, cloud uploads, provider logs, leak-site content, ransom communications and recovered files.

Evidential limits¶

Do not assume the group name used in the demand is accurate. Branding, notes and leak sites may be copied, shared or used deceptively.

Where a sample is provided, compare it with source records using hashes, filenames, metadata and content. A sample may prove possession of one item, may be drawn from an earlier breach, or may have come from another person with legitimate access. Preserve the route by which the sample was supplied.

Publication may occur through a leak site, direct message, file-sharing service or contact with third parties. Preserve each route separately and record whether the material was merely advertised, partially displayed or made available for download.

Operational takeaway¶

Treat encryption and data-theft claims as separate evidential questions, and assess the scope of any claimed possession from direct records and recovered samples.