Pay us, or we publish it. Pay us, or we keep your systems down. Pay us, or everyone you know receives the pictures.
Extortion does not sell a product. It sells relief from fear - and criminals manufacture both the fear and the deadline.
In 2025, the FBI's IC3 received 89,129 extortion complaints with $122.5 million in reported losses. It also received more than 75,000 submissions concerning sextortion.[ref] These are reported cases, not the full scale of the crime.
How criminals apply the pressure:
🔒 Ransomware and double extortion - Criminals encrypt systems, steal data, or do both. Backups remove some operational leverage, but stolen customer, employee, legal, or health data creates a second threat: pay, or it is leaked. CISA also documents data-theft extortion without any encryption at all.[ref]
📱 Sextortion - An offender obtains intimate material through deception, account compromise, coercion, or manipulated imagery, then demands money or more content. The FBI warns that offenders sometimes release the material even after payment.[ref] Shame is part of the weapon; the victim is not the offender.
🗃️ Stolen-data blackmail - Personal records, private messages, trade secrets, credentials, and browsing or location data become leverage. Criminals tailor threats to the person or organization behind the data, while stolen information also feeds identity theft and further fraud.[ref]
🌐 DDoS extortion - Criminals threaten to overwhelm an online service or demonstrate disruption before demanding payment. The demand targets the moment downtime hurts most: a launch, sale, match, payroll run, or trading day.[ref]
📣 Pressure beyond the victim - Extortion crews contact employees, customers, partners, journalists, or regulators to amplify reputational and legal pressure. The threat is no longer only "your files stay locked"; it is "we control who hears the story first."
🎭 Bluff and borrowed truth - Some threats rely on material the criminal never possessed. Others include an old password or personal detail from a breach to make a fabricated claim feel proven. A true detail does not make the whole threat true.
The criminal's advantage is urgency. The victim's advantage is a prepared response that replaces panic with decisions.
What to do:
For individuals:
- Do not negotiate alone. Preserve messages, account details, payment instructions, and timestamps; report the account to the platform and the incident to police or the relevant cybercrime authority.
- For sextortion, stop contact and tell a trusted person immediately. If a child is involved, treat them as the victim of a crime and seek specialist support. Do not forward intimate material while collecting evidence.
- Secure affected accounts from a trusted device: change reused passwords, enable MFA, review active sessions, and recover compromised email or social accounts.
- Use established removal services where relevant, such as NCMEC's Take It Down for images taken before age 18 or StopNCII.org for adults.
For organizations:
- Prepare a ransomware and data-extortion playbook covering containment, evidence preservation, legal advice, insurance, regulators, communications, law enforcement, and sanctions checks.
- Keep offline or suitably isolated backups and test restoration. Backups support recovery; they do not undo stolen data.
- Segment networks, protect remote access with MFA, patch internet-facing systems, restrict privileges, and monitor unusual data transfers.
- Never treat payment as guaranteed recovery or silence. CISA and the FBI discourage paying because payment does not guarantee restored files and funds further crime.[ref]
Extortion succeeds by making the victim feel alone and out of time. Break both conditions.