Data Extortion Without Encryption: When Hackers Steal Your Data Without Disrupting Your Servers

Imagine a Monday morning.

The computers start normally.

Email is working.

The invoicing software is working.

The file server is working.

Employees are getting on with their jobs.

No red warning screen.

No ransom note.

No encrypted files.

Everything seems normal.

Then the company director receives an email:

"We have copied your customer data, contracts, HR documents and financial information. Pay us, or we will publish them."

This is probably one of the most disturbing cybersecurity scenarios today.

For years, we have taught businesses to recognise cyberattacks by their visible consequences.

A server goes down.

Files become unreadable.

A ransom demand appears.

But cybercriminals are changing their methods.

They no longer necessarily need to break your systems.

Sometimes, all they need to do is steal your data and leave.

ANSSI Is Clearly Observing This Shift

This is not just a hypothesis.

In its Panorama de la cybermenace 2025, published in March 2026, France's national cybersecurity agency ANSSI reported a decline in ransomware deployment alongside a significant increase in attacks involving data exfiltration alone.

In 2025, the agency was informed of 196 incidents involving data exfiltration, with or without ransomware.

In 2024, it had handled 130 such incidents.

ANSSI also notes that some cybercriminal groups now steal data without deploying ransomware.

They then have several options.

They can resell the information.

They can sell access to other criminals.

They can use the data to prepare another intrusion.

Or they can contact the company directly:

"Pay, or we publish."

This is a much quieter form of extortion.

And for an SME, it completely changes how security needs to be approached.

Why Would Hackers Stop Encrypting Files?

Because encrypting a system also has disadvantages for the attacker.

Encryption creates noise.

Users immediately notice that something is wrong.

The IT provider gets called.

The network may be disconnected.

Security teams begin investigating.

Law enforcement may become involved.

The attacker reveals their presence.

Stealing data silently can be much more attractive.

A company may continue operating for several days without realising it has been compromised.

The attacker gains time.

They explore.

They search for important data.

They identify backups.

They examine customer folders.

They look for contracts, HR files, financial documents and trade secrets.

Then they exfiltrate whatever has value.

Only afterwards do they make themselves known.

The Problem: Backups No Longer Solve Everything

For a long time, a common response to ransomware was:

"We have backups, so we are protected."

Backups are an excellent security measure.

But they are not enough to protect against data theft and extortion.

Imagine that your servers are running perfectly.

Your backups are intact.

Your files have not been encrypted.

But the attacker now has copies of:

• Your customer database.
• Your contracts.
• Your invoices.
• Your employee records.
• Your commercial documents.
• Your technical data.
• Your internal communications.

Restoring a backup will not make the stolen copies disappear.

That is why this change matters.

Data availability is no longer the only concern.

Confidentiality becomes central.

"Our Business Is Still Running" Is No Longer Proof of Security

This is probably the most important shift in mindset.

An SME can be seriously compromised while continuing to operate perfectly normally.

No outage.

No error messages.

No obvious slowdown.

No ransom note.

The attacker may be using a legitimate account.

VPN access.

A Microsoft 365 account.

An administrator account.

A service provider's access.

A vulnerability in an internet-facing service.

Then they gradually copy data.

This is exactly what makes detection more difficult.

The question is no longer simply:

"Is anything broken?"

It becomes:

"Is someone using our systems in a normal-looking way to do something abnormal?"

The DGFiP Incident Illustrates This Problem Perfectly

The recent incident involving France's tax administration, the DGFiP, shows why this question is becoming essential.

In its official statement, the Ministry of Finance explained that unauthorised access had been detected and stopped.

However, the checks carried out at the time had not revealed that those intrusions had also resulted in data theft.

That distinction is extremely important.

Detecting an unusual connection is not always enough.

You also need to understand:

Which data was accessed.

How much information was downloaded.

Which searches were performed.

Whether unusual exports took place.

Whether an account behaved differently from its normal usage.

This is precisely the challenge facing modern businesses.

How Data Theft Can Happen in an SME

Consider a very ordinary scenario.

Someone in the sales department has their password stolen.

The company uses Microsoft 365.

The attacker logs in.

They do nothing spectacular.

They open the mailbox.

Then OneDrive.

Then SharePoint.

They examine the folders this user can access.

Gradually, they learn how the company works.

Who is the director?

Who works in accounting?

Who are the major customers?

Which documents appear sensitive?

Then they look for ways to obtain additional privileges.

Perhaps a password has been reused.

Perhaps a shared folder is accessible far too widely.

Perhaps an old administrator account still exists.

Perhaps a SaaS application contains a complete export of the customer database.

Throughout all of this, the company continues operating.

Then several gigabytes of data are copied.

And the problem is only discovered later.

Not All Data Has the Same Value

To an attacker, a file is not interesting simply because it is confidential.

It is interesting because it can be monetised.

A customer database can be used for phishing.

An HR file may facilitate identity theft.

Invoices can help prepare fraudulent bank-detail changes.

Contracts can reveal business partners and financial amounts.

Technical documents may help facilitate a future attack.

Customer communications can be used to create reputational pressure.

Credentials found in documents may provide access to other systems.

That is why an attacker may spend time carefully selecting what to steal.

They are not necessarily looking for "all the data".

They are looking for data that gives them leverage.

Cybermalveillance.gouv.fr Has Also Observed the Acceleration

Cybermalveillance.gouv.fr describes 2025 as a year marked by another acceleration in personal data breaches.

The organisation reports that major incidents exposed the information of millions of people in France.

Requests for assistance from individuals relating to these breaches increased by 107% in 2025, following an 82% increase in 2024.

The observed causes vary:

Security weaknesses.

Compromised accounts.

Computer intrusions.

Compromised service providers or partners.

In other words, data theft is no longer an exceptional event.

It has become a recurring part of the cybersecurity landscape.

Why SMEs Are Particularly Attractive

An SME may think:

"We do not have anything important enough to interest hackers."

That is rarely true.

Even a small business often holds:

Customer contact details.

Invoices.

Banking information.

HR records.

Contracts.

Access to other businesses.

Business emails.

Supplier information.

And perhaps most importantly, many SMEs have trusted relationships with much larger companies.

An SME may therefore be valuable not only because of its own data, but also as an entry point into its customers' environments.

This is the logic behind supply-chain attacks.

Cybermalveillance.gouv.fr specifically identifies incidents involving service providers or partners among the recurring causes of data breaches observed in 2025.

What Should You Actually Monitor?

A security strategy based solely on antivirus software and backups is becoming insufficient.

Businesses also need the ability to identify abnormal behaviour.

For example:

A user suddenly downloading several thousand files.

An account accessing folders it would not normally open.

An administrator creating new accounts.

A connection from an unusual location.

An unusual volume of data leaving the network.

Microsoft 365 being accessed from a new device.

A large export from a CRM.

A service provider account being used outside its expected working hours.

An old account suddenly becoming active again.

Individually, any one of these events may be legitimate.

But together, they may tell a different story.

This is precisely the purpose of security monitoring: connecting weak signals before they turn into a crisis.

First Measure: Identify Which Data Would Be Truly Disastrous to Lose

Every SME should be able to answer this question:

"If a hacker published 10 GB of our data tomorrow, which files would we absolutely not want to see exposed?"

That question is much more useful than an abstract inventory.

Perhaps it is your HR records.

Perhaps your customer contracts.

Perhaps your technical documentation.

Perhaps health information.

Perhaps financial records.

Once these datasets have been identified, you can begin checking:

Who can access them.

Where they are stored.

Whether they really need to be there.

Whether they are protected.

Whether access to them is logged.

Protection begins with understanding what you have.

Second Measure: Reduce Access Privileges

In many companies, employees accumulate access permissions over time.

A project begins.

Someone is granted access.

Another project begins.

More access is added.

Five years later, certain accounts still have privileges that nobody can really explain.

That is dangerous.

If an account is compromised, the attacker inherits all those privileges.

The rule should therefore be:

A user should only have access to the information required for their current work.

Not information they needed three years ago.

Third Measure: Monitor Accounts, Not Just Computers

Modern attacks often involve valid accounts.

So you need to monitor identities.

Who is logging in?

From where?

At what time?

From which device?

Which data is being accessed?

Which privileges are being used?

ANSSI also highlights the role of identity compromise and intermediaries such as Initial Access Brokers in the modern cybercriminal ecosystem.

Identity security is therefore becoming just as important as network security.

Fourth Measure: Monitor Data Leaving the Company

A company generally has some idea of how much data enters its systems.

Far fewer know exactly how much data leaves them.

Yet this is essential.

A CRM export.

An unusual cloud synchronisation.

A large copy operation to a workstation.

An archive created on a server.

A transfer to an external service.

These are events that should be explainable.

The objective is not to block every transfer.

It is to understand what normal activity looks like.

Because without a normal baseline, recognising abnormal behaviour becomes much more difficult.

What If the Attacker Contacts You?

Cybermalveillance.gouv.fr warns that attackers may steal information and then threaten to publish it unless a ransom is paid.

If this happens, the first rule is:

Do not improvise.

Do not respond in panic.

Do not pay immediately.

Do not delete systems or logs.

Keep the messages.

Preserve the evidence.

Contact your security team or IT provider.

Assess what was actually stolen.

Determine whether personal data is involved.

Involve management, legal advisers and the Data Protection Officer if necessary.

Prepare your crisis response.

Paying a ransom does not guarantee that the information will be deleted or that it will never be resold.

A digital file can be copied indefinitely.

A New Test for SMEs

Ask your IT provider this question:

"If someone copied 20 GB of customer data tonight without shutting down our servers, how would we know?"

The answer can be extremely revealing.

If the response is:

"We have backups."

That does not answer the question.

If the response is:

"We have antivirus software."

That is still not enough.

The real answer should involve:

Logging.

Monitoring.

Anomaly detection.

Identity management.

Access control.

Data transfer volumes.

Alerts and response capabilities.

That is where modern detection begins.

Where Cyberhack Can Help

At Cyberhack, our approach is precisely about not waiting for a server to be encrypted before recognising that a security incident has occurred.

Cyberhack Platform and our monitoring services can help organisations track, over time:

• Critical accounts.
• Sensitive access.
• Exposed services.
• Unresolved security risks.
• Anomaly indicators.
• Available evidence.
• Priority actions.

The objective is not to promise that nobody will ever steal a single piece of data.

Such a promise would be unrealistic.

The objective is different:

To reduce the likelihood that an attacker can remain undetected long enough to steal what truly matters.

Conclusion

For years, ransomware had a very recognisable image.

Encrypted servers.

Business operations brought to a halt.

A ransom demand.

That picture is becoming incomplete.

ANSSI is now observing an increase in attacks where cybercriminals simply exfiltrate data and then seek to monetise it or extort their victims directly.

This is a significant development.

Because a business can be seriously compromised while everything appears to be working perfectly.

Backups remain essential.

But they are no longer enough.

You also need to know:

Who can access your data.

Which information is genuinely critical.

How much data leaves the company.

Which behaviours are abnormal.

And how long it would take to detect a silent intruder.

So the right question is no longer just:

"Can we restore our data after an attack?"

It becomes:

"Will we know that our data is being stolen before the attacker contacts us?"

And today, for many SMEs, that is probably one of the most important cybersecurity questions to ask.