Ransomware groups will shift tactics as more victims refuse to pay, threatening to feed stolen data into AI models, reporting breaches to regulators, and reselling access to compromised systems. They'll use AI to analyze what they steal and craft more targeted extortion demands.
Chapters
In 2026, ransomware extortionists will adapt new tactics to monetize access to victims' data and systems with more personalized and vicious attacks. The ransomware industry has to deal with rising rates of victims who simply refuse to pay, so they will adapt in some interesting ways. They will increase the consequences by threatening to upload pilfered data into AI training models reporting the breach to regulators, reselling access to victims' environments, leveraging the victims' systems and access to hack partners and vendors, and perhaps worst of all, tamper with legitimate transactions over time to corrupt databases, making the task of cleanup and restoration much more complex and costly. They will also use AI to evaluate the vast amount of exfiltrated data to better understand the content and how to use that information in creative ways. All of these efforts are an evolutionary response to compel the unwilling victims to pay the ransom. This raises the bar for organizations to make sure they're well protected and resilient from these shifting types of attacks.
