How Data Extortion Is Redefining Cyber Security
Ransomware has changed dramatically. It is no longer confined to encrypting endpoints. Attackers now engage in data extortion, targeting entire digital ecosystems from SaaS platforms to internal networks. The stakes have never been higher.
The Rising Tide of UK Cyber Threats
Recent UK government research shows that around 1% of UK businesses, equating to roughly 19,000 firms, suffered a ransomware incident in the past year. Meanwhile, independent security reports reveal that more than two-thirds of UK victims had their data encrypted, a figure significantly higher than the global average. Ransom demands are rising too, with median demands in the UK now in the multimillion-pound range—double the levels seen only a year ago.
Despite this, there are encouraging signs. Fewer businesses are paying ransoms thanks to stronger backup and recovery strategies, including air-gapped and immutable storage. In 2025, only 17% of organisations in the UK admitted to paying, compared with nearly half just two years ago.
Data Extortion: The New Criminal Playbook
The UK’s National Cyber Security Centre has warned that ransomware is now as much about stealing sensitive data as it is about encrypting systems. Attackers use threats of disclosure to regulators, insurers, or customers as extra leverage. The NCSC highlights that extortion often includes the threat of publishing stolen information on the dark web, compounding reputational and regulatory risks.
Lessons from the Akira Ransomware Gang
One example that grabbed headlines was the Akira ransomware group. They initially demanded $600,000 but ultimately settled for $200,000. Disturbingly, after payment they sent the victim a “security checklist” that included advice such as:
- Don’t open suspicious emails.
- Use strong, regularly updated passwords.
- Enable multi-factor authentication.
- Keep systems patched.
- Monitor network traffic and maintain antivirus protection.
- Use VPN jump hosts with unique credentials.
- Train employees.
They even signed off with the line: “We wish you safety, calmness, and lots of benefits in the future.” It was an unnerving reminder that even criminals understand the basics organisations should already have in place.
Why Large Enterprises Remain Targets
Larger businesses continue to be prime targets despite increased awareness. The reasons are clear:
- The potential cost of downtime and data exposure often dwarfs the ransom demand.
- Complex IT environments and multiple third-party integrations create more entry points for attackers.
- Regulatory pressures and high customer expectations increase the damage of a breach.
The UK government is responding with stronger measures, including new guidance on sanctions and a forthcoming Cyber Security and Resilience Bill that will mandate higher security standards across critical industries.
PDQ’s Priorities for Cyber Resilience
| Focus Area Why It Matters |
| Backups & Recovery | Strong recovery is essential as fewer businesses pay ransoms. |
| Endpoint-to-Cloud Coverage | Protection must cover SaaS, networks, and endpoints alike. |
| Multi-Layer Defence | MFA, monitoring, and secure VPN use reduce vulnerabilities. |
| Policy & Training | Human error remains the weakest link. |
| Incident Planning | Effective planning enables rapid, decisive recovery. |
At PDQ, these fundamentals are non-negotiable. Ransomware continues to evolve, but so can your defences.
Taking the Next Step
Cyber threats are not slowing down, and preparation cannot wait. Strengthening resilience now can protect your business from costly downtime, reputational harm, and regulatory penalties. Prevention and recovery must go hand in hand.
PDQ partners with organisations to design tailored strategies that protect their full digital environment. From continuous monitoring and tested recovery plans to staff training, we ensure you are ready for whatever comes next.
Contact PDQ today to discuss how we can help secure your business.
Frequently Asked Questions (FAQ)
1. How common is ransomware in the UK?
Around 1% of UK businesses, or roughly 19,000 firms, reported a ransomware incident in the past year according to the Cyber Security Breaches Survey.
2. How much data is being encrypted and what are ransom demands like?
Over two-thirds of UK victims reported data encryption, significantly higher than the global average. Median ransom demands are now in the multimillion-pound range, roughly double last year’s levels.
3. Are UK companies paying ransoms?
Fewer businesses are paying than ever before. In 2025, only 17% of UK organisations admitted to paying, compared with almost half two years ago. This trend reflects the growing adoption of reliable backup and recovery systems.
4. What tactics are criminals using beyond encryption?
Attackers are increasingly stealing sensitive information as well as encrypting data. They then use threats of disclosure to regulators or customers to pressure victims into paying. Guidance from the NCSC warns that data theft is now a core part of the ransomware model.
5. What protections should organisations prioritise?
- Strong, regularly updated passwords.
- Multi-factor authentication.
- System and software patching.
- Network monitoring and antivirus protection.
- VPN jump hosts with unique credentials.
- Staff training to identify phishing and other threats.
- Regular testing of backup and recovery plans.
6. How does PDQ help businesses defend against ransomware?
PDQ Cyber Security supports your entire digital environment, not just endpoints. We help you build resilience through recovery planning, ongoing monitoring, and staff training, making recovery a central part of your security strategy.