Not Paying the Ransom Doesn't End It: Understanding Double Extortion

They didn't pay. So the hackers posted everything.

In September 2026, the ShinyHunters hacking group breached the Florida Department of Highway Safety and Motor Vehicles' DAVID database. When the agency didn't meet the group's demands, the hackers published hundreds of thousands of files on their leak site. According to TechCrunch, which reviewed a copy, the files included certificates of vehicle ownership with the names and addresses of buyers and sellers.

For years, the advice on ransomware was simple: have good backups, and you won't need to pay. That advice is still true for getting your systems running again. But it no longer covers the whole threat.

What double extortion means

Modern ransomware attacks usually happen in two stages:

1.       Steal. Attackers quietly copy as much sensitive data as they can, sometimes over days or weeks.

2.       Lock. Then they encrypt your systems and demand payment.

If you restore from backups, they threaten to publish the stolen data. If you refuse, many groups follow through, posting it on leak sites for anyone to download. Some even contact your customers directly.

In some cases attackers skip encryption entirely and simply steal and extort. There's nothing to restore, only data to protect.

Why this matters for small businesses

A Tampa Bay business might recover its systems in a day from good backups, and still face weeks of fallout from leaked data:

•         Breach notification obligations under Florida law

•         Calls from worried clients and partners

•         Regulators or carriers asking questions

•         Reputation damage that's hard to repair, especially in a close-knit community like Wesley Chapel

How to reduce the damage before it happens

You can't control whether criminals try. You can control how much they get and how quickly you notice.

1.       Keep less data. Old client files, scanned IDs, and spreadsheets from years ago are a liability. Set retention rules and purge what you don't need.

2.       Know where sensitive data lives. Data discovery tools find Social Security numbers and financial details sitting in unexpected places.

3.       Watch for data leaving. Large or unusual outbound transfers are often the first visible sign of the "steal" stage. Monitoring can catch it before encryption ever starts.

4.       Keep isolated backups. Backups still matter. Make sure attackers can't reach or delete them.

5.       Plan your communications. Your incident response plan should cover who contacts clients, your cyber insurer, law enforcement, and regulators, and what you'll say.

For Florida insurance agencies

Agencies hold exactly what extortion groups want: Social Security numbers, driver's license numbers, and financial details. Rule 69O-128.032 expects safeguards that protect that information, and data minimization is one of the most overlooked. Every file you don't keep is one that can't be leaked.

The takeaway

Paying a ransom doesn't guarantee your data stays private, and refusing doesn't make the problem go away. The best position is to have less to lose and to catch the theft early.

Main Event Managed Services helps Wesley Chapel and Tampa Bay businesses map their sensitive data, monitor for suspicious activity, and plan their response. Visit maineventmsp.com.

Sources: TechCrunch, Sept 16, 2026 · Privacy Guides roundup, Sept 18, 2026