Double extortion

In November 2019 the Maze group hit Allied Universal, a California security-services firm, and did more than encrypt: it had copied the files first, demanded about $2.3 million and posted an extract online to prove it held them. Double extortion is a tactical evolution of ransomware that emerged at scale around 2019 and 2020. Encryption locks the victim out of its data; the attacker has also exfiltrated that data beforehand, and threatens to publish it on a leak site if the ransom goes unpaid. That neutralizes the company's first line of defense, its backups. A victim able to restore its systems is still exposed to the disclosure of confidential data, whether customer, employee or intellectual property. The insurable loss changes nature. On top of remediation and business-interruption costs comes a liability risk tied to the data breach and to regulatory notification. Some groups have gone as far as triple extortion, adding denial-of-service attacks or contacting the victim's customers directly. For the insurer, double extortion blurs the line between cyber cover and liability cover, and pushes the market to state, policy by policy, whether cyber is expressly covered or excluded rather than left silent.