This interview was originally published in Hipther.com .
1. Why are cybercriminals increasingly choosing to steal data over encrypting systems?
The economics have changed and organised cybercrime groups are motivated by financial gain. Therefore the amount of time spent on an attack has a direct impact on the revenue they can generate.
A full encryption attack can be relatively resource-intensive and if a victim pays, the attacker may then need to provide a working decryptor and support the recovery process before moving on to their next target. Data-only extortion can be faster and simpler, while creating much the same financial pressure.
There is also significant value in the data itself and customer information or credentials can be used for extortion, where they are either sold to other criminals or exploited in follow-on attacks. Encryption certainly still happens and ransomware remains a serious threat but attackers increasingly recognise that they don’t necessarily need to encrypt systems to create leverage.
2. Most organisations are still set up to defend against encryption-based ransomware. What are they missing when it comes to spotting data theft?
Both data theft and encryption-based attacks are established threats and need to be taken seriously. Monitoring for data staging and mass data extraction should therefore be a mainstay of modern security monitoring.
The challenge is that data theft can be much more subtle than encryption. Once an attacker has gained trusted access through a compromised identity, their activity may look remarkably similar to legitimate user behaviour. They can spend time identifying valuable information and moving it out of the environment without creating the obvious disruption associated with ransomware.
Businesses need visibility over who is accessing sensitive data, whether that access is normal and where information is moving. The focus has to extend beyond preventing compromise to limiting what an attacker can reach and remove if they do get in.
3. How does UK data protection law, and the fear of an ICO investigation, factor into how attackers now pressure victims?
It gives attackers another source of leverage. So when personal information is stolen, the consequences can extend well beyond the immediate cyber incident into regulatory scrutiny, customer notification, legal costs and reputational damage.
Under UK data protection law, organisations generally need to notify the ICO of a personal data breach within 72 hours of becoming aware of it where the breach is likely to result in a risk to individuals. Attackers understand that pressure and the threat of publishing sensitive information can therefore be extremely powerful even when an organisation’s systems remain operational.
That’s one reason extortion-only attacks are attractive – an attacker can create a serious business crisis without needing to encrypt a single server.
4. For a mid-sized UK business without a dedicated security team, what’s the weakest point attackers are exploiting right now: credentials, cloud access, or insiders?
I would put identity and credentials first, although in practice these areas increasingly overlap. Attackers want trusted access. That might come from stolen credentials, phishing, a compromised cloud identity or even somebody inside the organisation being persuaded or paid to provide access.
For a mid-sized business, identity security is particularly important because an attacker using a genuine account can be much harder to identify than someone exploiting an obvious vulnerability. Criminals will generally look for the easiest route to legitimate access rather than trying to break through security controls head-on.
5. Has this shift toward data theft been gradual, or was there a clear turning point in the last six months?
It has been developing for some time, so I wouldn’t describe the last six months as a single turning point. What has changed during the first half of 2026 is how consistently different trends are now converging.
Across the intelligence we’ve reviewed, identity compromise, insider recruitment, cloud access, credential theft and extortion increasingly lead back to the same objective: obtaining valuable data. That’s why we describe 2026 as potentially the year of exfiltration risk.
6. With limited security budget, what should a UK business prioritise protecting first this year?
Prioritisation is key and not every sector or geography faces the same threats, so understanding who is most likely to target your organisation and how they operate enables security teams to focus limited resources where they will have the greatest impact.
Businesses should identify the systems and data most important to their continued operation and prioritise their protection. That might include intelligence-led patching, stronger identity controls and tighter privileged access around critical systems, rather than attempting to address every vulnerability with the same urgency.
For organisations with limited resources, the objective isn’t to buy every security product available. It’s to understand your most likely threats, identify what matters most to the business and make sure a single compromised account or vulnerability cannot expose everything that matters.
7. If an organisation suspects data has been stolen but systems haven’t been encrypted, what should their first move be?
Treat it as an active incident. The absence of encryption does not mean the danger has passed. The immediate priorities are to establish how the attacker gained access, contain that access, preserve evidence and determine what data may have been viewed or removed. That may mean disabling compromised accounts and investigating activity across cloud and SaaS environments.
Incident response, legal and data protection expertise should also be brought in early. If personal data is involved, the organisation needs to assess its regulatory reporting obligations quickly because the ICO’s 72-hour notification requirement may apply.
In an extortion-led attack, the stolen information may have been the attacker’s entire objective, however forensics may be required to confirm.
8. What influence is AI having on cyber security right now: more risk, more protection, or both?
AI is a double-edged sword because it can act as an efficiency multiplier for attackers and defenders. We’ve seen significant discussion over the past six months around capabilities available to threat actors, from large-scale vulnerability identification to the emergence of agentic AI in attacks. AI can accelerate reconnaissance, phishing, scripting and vulnerability discovery, compressing the time between an attacker deciding what they want to do and being able to act on it.
Perhaps more importantly it is lowering the barrier to entry. People who previously lacked the technical skills to conduct an effective cyberattack can increasingly use AI tooling to bridge that gap. That could contribute to an increase in the number of significant attacks we see over the coming months.
But defenders have access to many of the same advantages. AI can accelerate vulnerability identification, triage suspicious activity and help analysts process large volumes of information far more efficiently. The strongest use cases today are those where AI amplifies skilled security teams rather than replaces them. High-consequence decisions and incident response still require human judgement and oversight.
