Extortionists demand payment by threatening to publish private material or keep systems offline.

An extortionist has nothing to sell except relief - from a fear and a deadline they created themselves.

In 2025, the FBI's IC3 received 89,129 extortion complaints with $122.5 million in reported losses, plus more than 75,000 submissions about sextortion.^[ref] And those are only the people who reported it.

How the pressure gets applied:

🔒 Ransomware and double extortion - Criminals encrypt a victim's systems, steal the data, or both. Good backups take away some of the leverage. Stolen customer, staff, legal or health records bring it straight back: pay, or it gets leaked. CISA has also documented gangs that skip the encryption entirely and simply steal.

📱 Sextortion - The offender gets intimate material through deception, a hacked account or coercion, or simply fakes it with edited images, then demands money or more content. The FBI warns that some release the material even after being paid.^[ref] The offender counts on embarrassment to keep the victim quiet. In the Gulf, Abu Dhabi Police say many victims never report because they fear scandal, and the force offers a confidential 24-hour reporting line.^[ref] The victim is not the one who did wrong.

🗃️ Stolen-data blackmail - Personal records, private messages, trade secrets, passwords, browsing or location history all become leverage. The threat is tailored to whoever the data belongs to, and the same data keeps feeding identity theft and other fraud.

🌐 DDoS extortion - "Pay, or we take your site offline." Sometimes they run a short demonstration first. The demand lands when downtime hurts most: a launch, a sale, a match, a payroll run or a trading day.

📣 Pressure from every side - Extortion crews contact employees, customers, partners, journalists or regulators to turn up the reputational and legal heat. The aim is to take away the victim's control over who hears about the incident, and when.

🎭 Bluffs with a grain of truth - Some threats rest on material the criminal never had. Others quote an old password or personal detail from a breach to make an invented claim feel proven. Before treating the threat as real, check whether that detail could have come from an old breach.

The deadline is there to rush you into a decision. Knowing in advance who you will call and what you will not do takes some of that pressure away.

What to do:

For individuals:

- Do not deal with it alone. Keep the evidence first: messages, account names, payment instructions and timestamps. Then stop replying, block the offender on every channel, and do not pay or negotiate.

- Report the account to the platform and the crime to the police, and do it quickly. Digital evidence can be deleted or altered. The GCC reporting channels are listed below.

- With sextortion, tell someone you trust straight away. If a child is involved, they are the victim of a crime and need specialist support. Do not forward intimate material, even as evidence.

- From a device you trust, secure the affected accounts: change reused passwords, turn on MFA, sign out other sessions, and recover any hijacked email or social media account.

- StopNCII.org (for adults) and NCMEC's Take It Down (for images taken before age 18) help get intimate images removed from participating platforms.

Where to report in the GCC:

- UAE - The Ministry of Interior's cybercrime platform, in the MOI UAE app or on moi.gov.ae, open to individuals and companies in every emirate.^[ref] In Abu Dhabi, the police's confidential 24-hour Aman service: 800 2626, SMS 2828 or [email protected]. In Dubai, the Dubai Police eCrime platform.

- Saudi Arabia - The Kollona Amn app from Public Security, which lists blackmail among the cybercrimes you can report.

- Qatar - The Interior Ministry's Economic and Cyber Crime Combating Department, through Metrash2, email or phone.

- Bahrain - The General Directorate of Anti-Corruption and Economic and Electronic Security: hotline 992, WhatsApp +973 17108108 or its online form.

- Kuwait - The Ministry of Interior's cybercrime department.

- Oman - The Royal Oman Police or OCERT, the national computer emergency readiness team.

- Apps and numbers change. Confirm them on the official police or ministry website, never through links in the extortionist's messages. If you are in immediate danger, call the local emergency number.

For organizations:

- Write a ransomware and data-extortion playbook before you need it: containment, evidence, legal advice, insurance, regulators, communications, police and sanctions checks.

- Keep offline or properly isolated backups and test restoring from them. Backups restore systems; they do nothing about data that has already been copied out.

- Segment networks, put MFA on remote access, patch internet-facing systems, limit privileges and watch for unusual data transfers.

- Report incidents through official channels, such as the Ministry of Interior's cybercrime platform in the UAE, and tell your sector regulator. In Bahrain, Central Bank of Bahrain licensees must report fraud incidents and attempts to the CBB.^[ref]

- CISA and the FBI discourage paying.^[ref] A payment does not guarantee you get your files back or that stolen data stays private, and it funds the next attack.