how it happened
- whoMazeransomware group
- the gapbackupsrestored systems fine
- the resultdata leakeddouble extortion begins
what everyone assumed
The standard ransomware defense is recovery: keep good backups, refuse the ransom, restore. The assumption is that the attacker’s only leverage is locking your systems, which a backup defeats.
what happened
When the company refused, the attackers published a slice of the stolen data on a public site and raised the demand, threatening to release the rest. The backups restored the systems perfectly and did nothing about the copy now in the attacker’s hands, available to leak.
step by step
- Maze steals data and encrypts systemsAllied Universal's backups restore everything.
- the company refuses to payAbout $2.3 million is demanded.
- November 2019700 megabytes publishedThe backups do nothing about the copy in attackers' hands.the assumption breaks here
- double extortion spreadsA wave of imitators reshapes ransomware.
how it surfaced
In November 2019 the Maze operators pioneered this double extortion against Allied Universal, leaking 700 megabytes when a roughly $2.3 million demand was refused. The model spread to a wave of imitators and reshaped ransomware.
Backups answer encryption. They do nothing about theft.
Once an attacker has copied your data, restoring your systems leaves the leverage intact, because the data they hold cannot be restored into nonexistence.
picture it at a company like yours
The company here is made up. The other two paths are not: they happened, and each links to the story.
- in this storythe day it mattersYou restore from backup and refuse to pay.what it costs youThey publish your data instead, and backups cannot undo that.
- or it goes like thisit happenedCDK Global, 2024howYour main software vendor is hit and goes dark for two weeks.what leavessales, orders and invoicingwho ends up with itcompetitors, as customers go elsewhere
- or it goes like thisit happenedCode Spaces, 2014howBackups live where the attacker can delete them too.what leaveseverything, with nothing left to restorewho ends up with itthe business itself, which closes
sources
your turn
what you can do about it
this week
Check what an intruder could copy out, beyond what backups would restore.
Your ransomware plan probably assumes backups make payment unnecessary. Maze is why that is now half a plan: modern attackers steal before they encrypt. Whether your defenses also reduce what an intruder can reach and copy, not just what they can lock, is the other half.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →