Ransomware data extortion as a business model has continued to mature through 2024 and 2025 and is the dominant ransomware approach against Australian targets in 2026. The pure encryption-and-ransom model has largely been replaced by double-extortion (encrypt and exfiltrate) and increasingly by exfiltration-only operations that skip the encryption entirely.

The Australian incident response community has settled into a recognisable operational pattern responding to these attacks, but the strategic picture for affected organisations remains brutal.

The current attack lifecycle

The 2026 ransomware attack lifecycle against Australian targets typically runs as follows. Initial access via stolen credentials, infostealer-captured session tokens, or vulnerability exploitation. A dwell time of several days to several weeks during which the attacker establishes persistence, moves laterally, and identifies high-value data. Exfiltration of the high-value data, often to attacker-controlled cloud storage. Encryption deployment if the attacker has selected the double-extortion model. Ransom demand with a published deadline for payment, threats of data publication if the deadline is missed, and a sample of the exfiltrated data posted to the attacker’s data leak site as proof.

The operational tempo of the attack has compressed in some specific cases but the lifecycle is recognisable.

The exfiltration-only operations

A growing proportion of attacks against Australian targets in 2026 are exfiltration-only — no encryption is deployed, just data theft and a ransom demand. The attacker logic is straightforward. The attribution and prosecution risk is lower without encryption. The operational complexity is lower. The target organisation’s incident response is sometimes slower to recognise the compromise because the operational disruption is delayed.

For some Australian organisations, the exfiltration-only attack is harder to manage than the double-extortion variant because the recovery path is unclear. There is no encrypted environment to restore. The damage is the data exposure, and the response is principally legal, communications, and customer notification.

The data leak site economy

The data leak site ecosystem has continued to mature. The major ransomware operations run leak sites with operational sophistication that mirrors legitimate web operations — clear schedules for data publication, tiered disclosure with samples first and full archives later, automated countdown timers, and in some cases customer-facing search tools that allow third parties to search the leaked data for their own organisation’s information.

Australian organisations facing data leak threats are now routinely briefed by their incident response provider on what the specific leak site behaviour will look like and what the timeline pressure will be.

The payment decision

The decision whether to pay a ransom remains an organisation-specific, board-level decision in the Australian context. The legal position is nuanced — payment is not automatically illegal in most circumstances, but specific sanctions considerations apply depending on which threat actor is attributed. The OAIC and the ASD continue to recommend against payment in most cases. The practical reality is that some Australian organisations have paid in 2025 and 2026, often quietly, and the payment numbers are not publicly available at any systematic level.

The strategic argument against payment remains compelling — payment does not reliably stop data publication, encourages the broader market, and may not be the operational fastest path to recovery. The practical argument for payment in specific cases — the data is uniquely sensitive, the operational pressure is acute, the negotiated reduction is meaningful — continues to come up in individual board rooms.

The mandatory reporting question

The Cyber Security Act and the broader regulatory framework have continued to evolve in 2025 and 2026. Mandatory reporting obligations for cyber incidents have firmed up. The practical implication for Australian organisations is that the disclosure pathway for a serious cyber incident now includes regulatory notifications in a more structured way than five years ago, and the timeline for those notifications is unforgiving.

The control implications

The control implications for Australian organisations in 2026 are not new. Resilient identity infrastructure. Privileged access management. Endpoint detection and response. Network segmentation. Tested backup and recovery. Data classification and data loss prevention. Tabletop exercises that include the ransomware data extortion scenario specifically.

The organisations that have got these in place are not immune to ransomware data extortion but they have meaningfully better outcomes when an incident occurs. The organisations that have not are exposed in ways the 2026 threat picture punishes.