Ransomware data theft is the part of the attack that happens before you know there is an attack. By the time a screen tells you your files are encrypted, a copy of your customer records, your payroll files and your email archive has usually already left the building. The lock is the part you see, and the copy is the part that decides what the incident ends up costing you.
That order matters more than it sounds, because it breaks the plan most small companies believe they have. If your answer to ransomware is “we have backups”, you have a plan for the lock and no plan at all for the copy.
What ransomware data theft looks like from the inside
Nothing happens loudly. Somebody logs in with a password that was stolen weeks earlier, usually from a laptop that picked up malware or from a service that was breached and never mentioned it. That login is real, so nothing objects to it.
From there the attacker looks around, finds the folders that matter, and copies them out. Palo Alto Networks, which is called in to handle these incidents, reports that this stage has been getting dramatically faster every year, and that in its worst cases the data is on its way out the same morning it started. Only after the copy is finished does anything get locked, and the lock exists mainly to make sure you notice and start talking.
The second call is the one owners are not ready for. It carries a deadline, a sample of your own documents sent back to prove the copy is real, and a page on a leak site with your company name already on it.
Ask your IT provider: if somebody logged in as one of our staff at 2 a.m. and started copying folders, what would tell us, and how long would that take?
Why paying stops working once the data is gone
When files are encrypted and nothing was taken, paying buys a key, and the key either works or it does not. That transaction is unpleasant but it is at least legible.
When the data has been copied, you are being asked to pay for a promise to delete something you cannot verify, and there is no key to test, no way to confirm that a deletion happened, and no way to know whether a second copy sat somewhere else in the meantime. Owners work this out quickly once it is put in front of them, which is why a growing share of attackers now skip the encryption altogether and go straight to the threat of publication.
That shift is the reason ransomware data theft deserves its own line in your planning. A restore answers the lock, and it takes an afternoon or a weekend depending on how well your backups were built. Nothing you can buy answers the copy, so what you prepare for instead is what you will owe people once it has happened.
What ransomware data theft costs a company of your size
Sophos, a security vendor that surveys companies hit in the previous year, published figures in 2026 from 2,158 organizations across 17 countries, all between 100 and 5,000 employees.
The number worth your attention is the one for the smallest group. Among companies with 100 to 250 employees, only 34% managed to stop the attack before anything was encrypted or before an extortion demand arrived. In the same survey, the average cost of recovering from an incident came to $1.7 million, up 11% on the year before, and that figure excludes any ransom paid.
Read those numbers honestly. Everyone in that survey was already hit, so it does not tell you your odds of being attacked. Every company in it also employs somebody whose job is technology, which is more than many 30 person businesses have. What transfers is the direction of travel: the smaller the company, the further into the attack it gets before anybody reacts, and that is a question of who is watching rather than of what software was bought.
The $1.7 million average is likewise skewed by the larger companies in the sample. Do not budget against it. Use it for the shape of the cost, which is mostly downtime, staff time and outside help, and only rarely the ransom itself.
The obligations that arrive after the copy
This is the part that turns a technical incident into a business one, and it is worth understanding before it happens rather than during.
Once customer or employee data has left, you are no longer only dealing with attackers. Every American state has a law requiring you to notify people whose personal information was taken, with its own definitions and its own clock. If you hold health information or work with regulated clients, there are additional duties on top. Your customer contracts probably contain a notification clause you signed years ago and have not read since.
What triggers all of that is the copy rather than the lock, which is the detail most owners miss. A company that restores from backup over a weekend and tells nobody, when data really did leave, has an unresolved legal problem sitting quietly underneath a solved technical one.
Ask your IT provider: if data left our network, who determines what was taken, and how fast can they produce that list?
That question is the one most providers cannot answer, and finding that out on a normal Tuesday is far better than finding it out in week one of an incident.
What to change while nothing is happening
There are 3 things that reduce your exposure to ransomware data theft in a company without a security team, and all 3 are conversations rather than purchases.
First, know who is watching the logins outside working hours and what they are expected to do when one looks wrong. If the honest answer is that alerts land in an inbox somebody reads on Monday, that is your gap.
Second, put the second step on the accounts that reach your data from anywhere, so that a stolen password on its own is not enough. This is the single change that most often turns an incident into a failed attempt.
Third, write down now who gets called in the first hour, in what order, and who is allowed to speak for the company. Include your insurer, because most policies require their approval before you engage anyone and can refuse to cover costs incurred without it.
The questions to bring to whoever handles your technology
- What would tell us that a large volume of files had left our network, and who sees that alert?
- Which accounts can reach our customer data from outside the office, and does a stolen password alone get somebody in?
- If we were told our data had been copied, how would we determine what was in it?
- Who do we call first, and does our insurer have to approve them before we start?
- When did we last restore from backup as a test, and how long did the whole thing take?
If question 5 has never been answered with a date and a duration, start there. It is the cheapest item on the list and it is the one that decides how long the lock keeps you closed.
There is one more habit worth building while nothing is on fire. Once a quarter, ask what data your company holds that you would not want published, and where it lives. Most owners discover the answer is wider than they assumed, because old customer files, scanned identity documents and years of email attachments accumulate in places nobody chose. Deleting what you no longer need is the only measure on this page that reduces what an attacker can take, and it costs nothing but an afternoon.
Ransomware data theft has moved the center of gravity of these attacks away from your files and toward your obligations. The technical side stays with your provider. The part that lands on your desk is deciding, in advance, what you will say and to whom.
