Ransomware Extortion

Ransomware extortion is the offense of deploying malicious software that encrypts a victim's data or locks them out of their own computer systems, then demanding payment, typically in cryptocurrency, in exchange for restoring access, combining unauthorized computer access with the coercive demand-for-payment structure of traditional extortion applied to digital infrastructure. Modern ransomware operations frequently add a second layer of coercion known as double extortion, in which the attacker also exfiltrates a copy of the victim's data before encrypting it and threatens to publicly release or sell the stolen data even if the victim restores their own systems from backup without paying, increasing pressure on victims who might otherwise decline to pay a ransom. The offense has grown from a largely individual-victim nuisance into a major organized transnational criminal enterprise, with some ransomware operations functioning on a ransomware-as-a-service model in which developers lease their malicious software to affiliated criminal operators in exchange for a share of extorted proceeds, a structure criminologists studying cybercrime treat as a significant evolution in organized digital crime. Ransomware attacks against hospitals, municipal governments, and critical infrastructure operators have drawn particular law-enforcement and national-security attention beyond ordinary extortion cases, given the potential for the attack itself, independent of any ransom paid, to cause serious disruption to essential public services.