Ransomware Groups Ditch Encryption and Shift to Pure Data Theft — Your Backups Won't Save You

The ransomware playbook is changing in a way that most businesses are not prepared for. Threat actors are increasingly skipping the step where they encrypt your files and just stealing data instead. The extortion still happens — they threaten to publish your files publicly — but because no encryption occurs, your backup and disaster recovery plan provides zero protection. You cannot restore your way out of a data leak. A group called The Gentlemen jumped from 35 victims in Q4 2025 to 182 victims in Q1 2026, making it the second most active ransomware operation almost overnight. Ransomware groups are also increasingly recruiting corporate insiders to help them gain initial access, targeting employees at companies going through layoffs or cost-cutting. The US accounted for 51 percent of all ransomware victims globally in Q1 2026. Your response to this shift has to include data loss prevention controls, monitoring for unusual outbound data transfers, and tightening access so employees can only reach data they genuinely need for their jobs.