Extortion Without Encryption: The Tabletop Your Ransomware Plan Is Missing

Every disaster recovery plan written in the last decade answers the same question: how fast can we restore?

Recovery time objectives. Recovery point objectives. Immutable backups, offline copies, restoration drills, the quarterly exercise where someone simulates encrypted file shares and the team proves it can bring production back inside the window.

That plan is well built. It is also pointed at an attack a growing number of groups have stopped running.

In January 2026, a group called WorldLeaks published approximately 1.4 terabytes of Nike’s internal material — product designs, manufacturing workflows, pricing, audit results, partner data, production plans, supplier information. Nothing was encrypted. Every Nike system kept working. There was nothing to restore, because nothing was broken.

If that happened to your company tomorrow, your recovery plan would execute perfectly and accomplish nothing.

This is the tabletop nobody runs, and how to build it.

Why Attackers Stopped Encrypting

The Economics Changed, and We Caused It

Encryption was always the means, not the goal. The goal was leverage.

For years, locking files produced that leverage reliably. Then organizations got good at the exact thing the industry told them to get good at — immutable backups, tested restoration, segmented recovery environments. As one security awareness advocate put it when the shift became visible, many groups had been experimenting with data theft only, especially as organizations got better at quickly restoring from file encryption, so that part carries less weight.

We solved the encryption problem well enough that encryption stopped being worth the trouble. The attacker response was not to build better ransomware. It was to drop the ransomware and keep the leverage.

Group-IB’s reporting captured the operators’ own reasoning plainly: from the administrator’s perspective, ransomware is no longer profitable and risky. Encryption is loud, it triggers alarms, it invites law enforcement attention, and it requires building and maintaining a payload. Quiet exfiltration requires none of that and produces a threat the victim cannot engineer their way out of.

What WorldLeaks Actually Is

Worth knowing precisely, because the lineage explains the strategy.

WorldLeaks launched on January 1, 2025 as a direct rebrand of Hunters International, a ransomware-as-a-service operation active since late 2023 and widely assessed as a successor to the Hive gang. Hunters International wound down its encryption operations and reportedly released free decryptors on the way out.

The new operation runs as extortion-as-a-service, built around a proprietary exfiltration tool that automates large-scale data theft rather than an encryption payload. It has claimed well over 150 victims since January 2025, including Nike, Dell, UBS, and Tata Electronics.

That is not a fringe experiment. That is a functioning business model with an affiliate network behind it.

Do Not Assume Encryption Is Off the Table

One correction worth carrying into your planning, because the clean narrative is slightly wrong.

In January 2026, Darktrace investigated a healthcare compromise it attributed to WorldLeaks in which the attackers did deploy a ransomware payload and encrypt data — contradicting the group’s extortion-only reputation. The encryption capability inherited from the Hunters International codebase has not disappeared.

So the correct planning posture is not “they will not encrypt.” It is “encryption is now optional, and the extortion works either way.” Your plan has to cover both, and right now most plans cover only one.

Why Your Current Plan Does Not Cover This

Every Objective You Set Assumes Restoration

Look at what your continuity plan actually measures. Recovery time objective: how long until systems are back. Recovery point objective: how much data we lose to the last good backup. Both are restoration metrics. Both are meaningless when nothing was taken away from you — it was copied.

There is no equivalent objective for “the data is now in someone else’s possession permanently.” No timeline brings it back. No backup reverses it. The exercise your team has rehearsed twenty times does not contain a single decision that applies.

You Are Probably Protecting the Wrong Thing

This is the harder problem underneath, and it is the one that applies most directly to technology companies.

Most security programs scope their crown jewels to whatever a regulator or auditor would ask about — personal information, payment data, protected health information, financial records. That scoping is rational. It is also the reason Nike’s stolen material was, by the company’s own account, not customer or employee personal data at all.

For a startup or a scaling technology company, the most valuable thing in the building frequently carries no regulatory designation whatsoever:

• Source code and architecture — the thing your engineers spent three years building
• Product designs and unreleased roadmap — what your competitor would pay most to see
• Customer and pipeline lists — the commercial map of your business
• Pricing models and contract terms — how you win deals, handed to everyone you compete against
• Supplier and partner agreements — your operational dependencies, exposed
• Model weights, training data, and prompts — increasingly the actual product

None of that triggers a breach notification statute. None of it has a regulator waiting. And a competitor who obtains it faces no disclosure obligation either, which is exactly why this category of loss never shows up in a standard incident cost model.

Intellectual property is the asset class technology companies protect most carefully in employment agreements and most carelessly in their security architecture.

Running the Exfiltration-Only Tabletop

The fix is not a product. It is a two-hour exercise your leadership team has never run.

The Scenario

Keep it brutally simple, because the simplicity is the point.

A group posts your company name on a leak site. They claim to hold a specific volume of internal data and publish a directory listing as proof. Nothing in your environment is encrypted. Every system is operating normally. Monitoring shows no active intrusion. The sample they published is real.

That is the entire premise. No malware to contain, no systems to restore, no outage to manage. Just a countdown and a decision.

Who Is in the Room

This is where most organizations get it wrong by running it as a technical exercise.

The required participants: the CEO or founder, legal counsel, the security lead, communications or marketing, the finance lead, and whoever owns customer relationships. Technical staff are present but they are not the decision-makers — there is very little for them to do in this scenario, which is itself the lesson.

If your incident response plan routes this to the security team, the exercise will reveal that in the first fifteen minutes.

The Injects

Run it in sequence and do not let the group skip ahead:

• Inject one — the leak site post appears with a 72-hour countdown. What is the first action, and who takes it?
• Inject two — a reporter emails asking for comment. Who responds, and what is approved to say in the next two hours?
• Inject three — the sample contains a customer’s confidential information. What is your contractual notification obligation to that customer, and does anyone in the room know?
• Inject four — the attackers name a figure. Who has the authority to approve or refuse payment, and does a decision threshold exist?
• Inject five — the countdown expires and the full set is published. What do you tell customers, employees, investors, and the market?
• Inject six — three weeks later, a competitor ships something that resembles your unreleased work. What do you do now?

The Decisions You Are Actually Rehearsing

The scenario is a vehicle. These are what the exercise exists to surface:

• Can you determine what they actually have? If you cannot reconstruct what left the environment, you are negotiating and disclosing blind.
• Who decides whether to pay, and on what basis? Note the comparison from the episode: Coca-Cola did not negotiate after the Fairlife ransomware event and resumed the majority of production across its four US facilities within eleven days. That was a decision made against a prepared framework, not invented under pressure.
• What is your materiality threshold, and did you define it before today? If you have not defined it, a regulator or an opposing attorney will define it for you, and their definition will not be generous.
• What are your contractual notification obligations? Most enterprise agreements contain security incident notification clauses with timelines shorter than any statute. Almost nobody reads them until the incident.
• What does the public statement say? Nike’s statement that no customer or employee personal data was found drew immediate skepticism, including on our own episode. If your statement is technically accurate and reads as evasive, you have spent credibility without buying anything.

The Five Questions That Have No Owner

Run the exercise and the same five gaps surface in nearly every organization. Find out now which ones are yours.

• What is our most valuable data, and is it the same data our security program is scoped to?
• Who in this company can state what left the network in the last ninety days?
• Who approves a payment decision, and at what dollar threshold does it escalate to the board?
• Which customer contracts obligate us to notify, and in how many hours?
• Who writes and approves the public statement, and do they have a draft today?

Every one of those is answerable in a quiet week and unanswerable in a loud one.

What Changes Afterward

A tabletop that produces no architectural change was theater. Three things usually come out of this one.

Detection Has to Watch Volume, Not Just Payloads

If your only ransomware alarm is files being encrypted, the model that is winning will not trigger it. You need alerting on egress volume anomalies, large or unusual data movements to cloud storage and file-sharing services, and access patterns where an account suddenly reads far more than its historical baseline.

The window is wider than people assume. IBM puts the average time to identify and contain a breach at 241 days — moving terabytes out of a network is not a smash and grab, it is months of quiet work you had the opportunity to notice.

Access Scope Has to Shrink

Exfiltration at that scale requires an account that can reach that much. Least privilege stops being a compliance checkbox when the question becomes how much a single compromised identity could read in an afternoon.

Start with the initial access vector that keeps appearing — our field guide on help desk social engineering covers the verification protocol that closes the most common one.

The Payment Decision Needs a Model

The decision is financial and it should be prepared financially. What does the exposure cost if published — competitive damage, customer attrition, contractual penalties, deal cycles that stall — against a demand of a known size, with no guarantee of deletion in either direction.

Our field guide on quantifying cyber risk in dollars covers the method. The work is unpleasant and it is far better done in a conference room than on a countdown.

Where Audit Readiness Fits

Tabletop exercises and business continuity planning sit inside our Disaster Preparedness and Recovery pillar, and they produce the same thing a regulator, an enterprise customer, or an acquirer will eventually ask for: evidence that the plan exists, has been tested, and was updated based on what the test found.

That evidence requirement is also where Audit Readiness connects. Assessment establishes what your actual crown jewels are and where they are reachable from. Remediation closes the gaps the exercise surfaces, in the order that reduces exposure. Liaison is representation during the assessment itself — the keystone step when an enterprise buyer starts asking how you would handle exactly this scenario.

Our Tech Startups industry brief covers the broader posture enterprise buyers and acquirers examine.

Marching Orders

1. Name Your Crown Jewels Without Looking at a Regulation

List the five things whose publication would hurt this company most. Do it without reference to any compliance framework. Then compare that list to what your security program is actually scoped to protect. The gap between those two lists is the finding.

2. Schedule the Exfiltration-Only Tabletop This Month

Two hours. Leadership in the room, not just security. Use the scenario and the six injects above. Do not let anyone solve it technically — the entire premise is that there is nothing technical to solve.

3. Write Down Your Materiality Threshold

Define what material means for your organization, document the reasoning, and name who makes the call. If you do not define it, a regulator or an opposing attorney will, and you will be defending a standard you had no part in setting.

4. Read the Notification Clauses in Your Top Ten Customer Contracts

Most enterprise agreements carry security incident notification obligations with timelines measured in hours. Find out what you have already promised before you are in a position where missing it is a breach of contract on top of a breach of data.

5. Build Egress Detection This Quarter

Alert on volume anomalies, unusual movement to cloud storage and file-sharing platforms, and accounts reading far beyond their baseline. 241 days is the average time to identify and contain a breach — that is a long runway you are not currently watching.

6. Draft the Public Statement Now

One page, written calmly, approved in advance, with the facts left blank. A statement composed under a countdown reads like one, and your customers can tell.

Execute the Standard

The uncomfortable part of this story is that the industry earned it. We told organizations to build immutable backups and test their restores, and enough of them did it that encryption stopped paying. The attackers adapted faster than the playbooks did.

What replaced it is a scenario with no technical remedy at all. Nothing to patch, nothing to restore, nothing to contain. Just a decision about money, a decision about disclosure, and a statement that either sounds credible or does not — made by people who have, in most companies, never once practiced making them.

That is a solvable problem, and it costs two hours and a conference room.

If you need help running the exercise, building the crown jewel analysis behind it, or producing the evidence an enterprise buyer will ask for, that is the work we do. Verify your security posture or book a strategy call.

Name the crown jewels. Run the tabletop. Write the threshold down.

Execute the standard.