Key figure: The global average cost of a data breach was $4.44 million in 2025 (IBM, Cost of a Data Breach Report 2025).
Double extortion is the ransomware tactic where attackers steal your data before encrypting your systems. Data breach news in 2026 identifies it as the dominant attack model. This free 8-question quiz tests whether your organization could survive one.
Data breach news throughout 2026 shows double extortion — where attackers steal your data before encrypting it — has become the standard ransomware playbook. Even victims who restore from backups still face public leaks. The best defenses are tested offline backups, network segmentation, and an incident response plan you have actually rehearsed. This free quiz scores your readiness across 8 scenarios.
Double extortion is a ransomware tactic with two threats: attackers first steal sensitive data, then encrypt your systems. If you refuse to pay for decryption, they threaten to publish the stolen data. It defeats backup-only recovery plans.
Ransomware gangs don't just encrypt your files anymore. They steal your data first, then threaten to publish it on a dark-web leak site — so even perfect backups can't save you. Eight questions, 30 seconds: would your business survive?
Short answer: the double-extortion model — encrypt your systems AND threaten to leak your stolen data — means "we have backups" is no longer a complete answer. October 2026's victim list is fresh. Take the quiz, then fix the gaps before you're on next month's list.
Backups answer Move 1. Nothing in "we have backups" answers Moves 2 and 3. That's the gap this quiz measures.
Victim disclosures as reported October 2026. Three industries, three gangs, one playbook. Which of these companies do you resemble most?
Answer honestly. The ransomware gang won't grade on a curve.
Then retake the quiz. Eight green answers is the goal.
A ransomware attack in two moves: the gang encrypts your files (so you can't work) AND steals your data, threatening to publish it on a dark-web leak site (so you pay even if you can recover). Restoring from backups defeats the encryption half, but does nothing about the stolen-data half — which is why backups alone don't save you.
Only against the encryption half. Offline, tested backups let you restore operations without paying for a decryption key — but in a double-extortion attack the criminals also stole your data and threaten to publish it on a leak site. Backups are essential and not sufficient: you also need to stop the initial intrusion and the exfiltration.
Disclosed victims this month include Pantanal Agricola, listed by Thegentlemen (disclosed October 16, 2026); Reed & Giordano PA, listed by Rhysida (October 11, 2026); and Yarema, listed by Akira (October 9, 2026). All three follow the double-extortion model: encrypt the victim's systems and threaten to publish stolen data.
A site run by a ransomware gang — typically on the dark web — where they publish (or threaten to publish) data stolen from victims who refuse to pay. Being listed is the second half of the double-extortion squeeze: even a company with perfect backups can be pressured by the threat of customer data, contracts, or internal documents going public.
Run the eight checks on this page: offline tested backups, network segmentation, MFA on all remote access, monitored EDR, phishing training, a written incident response plan, data classification with access limits, and dark-web leak-site monitoring. The fastest wins for most small businesses are enabling MFA on remote access today and verifying one backup restore this week.
A ransomware attack in two moves: the gang encrypts your files (so you can't work) AND steals your data, threatening to publish it on a dark-web leak site (so you pay even if you can recover). Restoring from backups defeats the encryption half, but does nothing about the stolen-data half — which is why backups alone don't save you.
Only against the encryption half. Offline, tested backups let you restore operations without paying for a decryption key — but in a double-extortion attack the criminals also stole your data and threaten to publish it on a leak site. Backups are essential and not sufficient: you also need to stop the initial intrusion and the exfiltration.
Disclosed victims this month include Pantanal Agricola, listed by Thegentlemen (disclosed October 16, 2026); Reed & Giordano PA, listed by Rhysida (October 11, 2026); and Yarema, listed by Akira (October 9, 2026). All three follow the double-extortion model: encrypt the victim's systems and threaten to publish stolen data.
A site run by a ransomware gang — typically on the dark web — where they publish (or threaten to publish) data stolen from victims who refuse to pay. Being listed is the second half of the double-extortion squeeze: even a company with perfect backups can be pressured by the threat of customer data, contracts, or internal documents going public.
Run the eight checks on this page: offline tested backups, network segmentation, MFA on all remote access, monitored EDR, phishing training, a written incident response plan, data classification with access limits, and dark-web leak-site monitoring. The fastest wins for most small businesses are enabling MFA on remote access today and verifying one backup restore this week.
Keep hardening before you're a headline: