The ransomware economy is shifting toward straight-up data extortion

Google Threat Intelligence Group’s 2025 findings show a notable shift in financially-motivated cybercrime from encrypt-and-extort ransomware toward data-theft-only extortion, with data-leak site posts rising and unique leak sites increasing; exploited vulnerabilities (notably in VPNs and firewalls), web compromise, and stolen credentials were the leading initial access vectors, attackers increasingly targeted virtualization infrastructure like VMware ESXi, and several ransomware families and active brands were identified.