Varonis: How Hackers Shifted from Encryption to Data Theft

Name: Varonis: How Hackers Shifted from Encryption to Data Theft
Uploaded: 2026-08-23T09:28:46-04:00
Duration: 20 s
Description: Learn how hackers' processes have changed in the age of AI. Previously, hacking groups (like the Shiny Hunters hacking group) would encrypt and hold the unlock behind a ransom. Now, they just steal data and use that as leverage.

Varonis

08/23/2026

0 (0%)

Report Like Favorite

TL;DR

Modern attackers have shifted from encryption-based ransomware to data theft, using stolen sensitive information as leverage instead of locking systems.
Threat groups like ShinyHunters now locate and query data intelligently, targeting high-value assets such as PII and payment contracts regardless of where data resides.
The absence of encryption makes these attacks harder to detect, rendering traditional ransomware defenses and backup strategies less effective against this evolving threat.

Summary

This short-form clip from Varonis captures a critical shift in modern attacker behavior: ransomware groups have largely abandoned encryption-first tactics in favor of pure data exfiltration. Where threat actors like ShinyHunters once relied on locking victims out of their own systems to demand ransom, the new playbook prioritizes stealing sensitive data and using it as leverage directly. Attackers no longer need to encrypt anything — they simply locate data wherever it lives, query it intelligently to extract high-value assets like PII and payment contracts, and threaten exposure. The message is stark: perimeter defenses and backup strategies alone are insufficient when adversaries can find, access, and exfiltrate your most sensitive information without triggering traditional ransomware detection. Organizations must rethink data security posture to account for this stealthier, data-centric threat model.

Chapters

0:00 - Encryption vs. Data-First Attacks
0:06 - How Attackers Find and Query Data
0:16 - High-Value Targets: PII and Contracts

Key Quotes

0:00 "Attacks predominantly used to be encryption first. Now it's data first, practically no encryption."
0:06 "It doesn't matter where the data is, they will find where that data is."
0:10 "If they see it and they find it and they can query it, they will query it with a really good query that gets all the nice stuff they want out of there."
0:19 "They want the leverage."

FAQ

Why have attackers moved away from encryption-based ransomware?

Encryption requires more effort and can be countered with backups. Data theft is stealthier, harder to detect, and equally effective as leverage — attackers simply threaten to expose stolen PII or contracts rather than locking systems.

What types of data are attackers targeting in these exfiltration-first attacks?

According to the clip, attackers specifically seek high-value assets like PII data and payment contracts — information that creates maximum legal, financial, and reputational exposure for victims.

Categories:

Tags:

Show more Show less

TL;DR

Summary

Chapters

Key Quotes

FAQ

Bridging the SaaS Protection Gap: Preventing Data Loss and AI Missteps

The Automation Escalation: Discovering the AI-Driven Underground Revolution

Invisible Data: Understanding What You Can't Safeguard