Incident Response Runbook: Data Extortion Without Encryption

Purpose of This Template

When attackers exfiltrate data without using ransomware, your usual incident response plan may not suffice. The UK Department for Education breach highlights this issue: ExfilSquad claimed to have accessed over 600,000 pieces of data from two DfE portals and demanded payment, but they didn't encrypt anything.

This runbook template is designed for handling data extortion incidents where you're faced with a payment demand, but your systems remain operational. It's particularly useful for public sector entities and organizations in critical national infrastructure that operate under no-ransom policies. However, any CISO can use it to respond when criminals threaten to publish stolen data.

Use this template when you confirm unauthorized data access but find no encryption, system lockouts, or traditional ransomware indicators. The focus shifts from recovery to containment, evidence preservation, and regulatory notification.

Prerequisites

Before activating this runbook, ensure you have:

• Authority to make containment decisions without waiting for executive approval (document this delegation in your incident response plan).
• Access to forensic preservation tools that can capture system state without alerting the attacker.
• A pre-identified legal contact who understands your regulatory notification obligations, such as the General Data Protection Regulation's 72-Hour Notification Requirement.
• Communication templates for affected individuals, regulators, and internal stakeholders.
• Your organization's policy position on ransom payments documented and approved by your board.

If you're subject to the UK's proposed ban on ransom payments for public sector and critical infrastructure entities, document that policy constraint now. Your incident commander needs to know payment isn't an option before they're in the middle of an extortion call.

The Runbook Template

Phase 1: Initial Detection and Scoping (Hour 0-2)

Trigger: Extortion demand received or detection of large-scale data exfiltration.

Immediate actions:

☐ Activate Computer [Security Incident](/glossary/security-incident) Response Team
☐ Preserve the extortion communication (do not respond yet)
☐ Identify compromised systems/portals
☐ Confirm operational status (systems running normally?)
☐ Document timestamp of first detection
☐ Notify legal and privacy teams
☐ Begin evidence preservation

Decision point: Is this pure extortion (no encryption) or ransomware? If systems are encrypted, switch to your ransomware playbook.

Scoping questions:

• Which systems did the attacker access?
• What data categories were exposed? (Contact details? Financial records? Special category data under GDPR?)
• How many individuals are affected? (Note: The DfE spokesperson clarified their 600,000 figure referred to lines of data, not individual count.)
• What's the earliest evidence of unauthorized access?

Phase 2: Containment and Evidence Collection (Hour 2-8)

Containment actions:

☐ Isolate compromised portals/systems (if safe to do so)
☐ Reset credentials for affected service accounts
☐ Review access logs for lateral movement
☐ Identify and close the initial access vector
☐ Deploy additional monitoring on adjacent systems
☐ Document all containment actions with timestamps

Evidence preservation:

☐ Capture memory dumps from affected systems
☐ Preserve authentication logs (minimum 90 days prior)
☐ Export network traffic captures
☐ Document attacker communications verbatim
☐ Screenshot attacker-controlled leak sites (if applicable)
☐ Preserve any ransom notes or payment instructions

Critical: Do not modify systems until forensic images are captured. Your legal team may need this evidence if you pursue prosecution.

Phase 3: Impact Assessment and Notification Planning (Hour 8-24)

Data classification review:

☐ Categorize exposed data by sensitivity:
   - Public information (low risk)
   - Internal contact details (moderate risk)
   - Personal data under GDPR (notification required)
   - Special category data (heightened notification)
   - Confidential/classified (immediate escalation)

☐ Map data to affected individuals:
   - Employee count
   - Customer/citizen count
   - Third-party contacts
   
☐ Assess harm potential:
   - Identity theft risk
   - Financial fraud risk
   - Physical safety risk (e.g., law enforcement personnel exposure)
   - Reputational harm

Regulatory notification assessment:

☐ Does this breach meet GDPR notification thresholds?
   - Risk to rights and freedoms of individuals?
   - Likely to result in harm?
   
☐ Calculate notification deadline (72 hours from awareness)
☐ Identify supervisory authority
☐ Draft notification content:
   - Nature of breach
   - Categories and approximate number of data subjects
   - Likely consequences
   - Measures taken or proposed
   
☐ Determine if individual notification is required
☐ Check sector-specific notification rules

Phase 4: Extortion Response Strategy (Hour 24-48)

Policy confirmation:

☐ Verify organizational policy on ransom payments
☐ Document legal constraints (UK public sector ban, insurance terms)
☐ Brief executive team on no-payment rationale
☐ Prepare communication for attacker (if engaging)

If you engage with the extortionist (to gather intelligence, not to negotiate payment):

☐ Use a dedicated, monitored communication channel
☐ Do not confirm or deny data accuracy
☐ Request proof of access (but verify it's not publicly available data)
☐ Document all exchanges
☐ Coordinate with law enforcement before responding
☐ Never commit to payment or provide financial information

Alternative response options:

☐ Public disclosure before attacker publication (control the narrative)
☐ Law enforcement coordination for takedown
☐ Threat intelligence sharing with sector peers
☐ Proactive notification to affected individuals

Phase 5: Recovery and Hardening (Week 1-4)

☐ Rebuild or restore compromised systems from clean backups
☐ Implement additional access controls:
   - [Multi-factor authentication](/glossary/multi-factor-authentication) on all portals
   - [Principle of Least Privilege](/glossary/principle-of-least-privilege) review
   - [Just-in-Time Access](/glossary/just-in-time-access) for administrative functions
   
☐ Deploy enhanced monitoring:
   - Data exfiltration detection
   - Unusual authentication patterns
   - Large file transfers
   
☐ Update incident response plan based on lessons learned
☐ Conduct tabletop exercise for pure extortion scenarios
☐ Review third-party portal security (if vendors were involved)

How to Customize This Runbook

For your sector:

• Add sector-specific notification requirements (HIPAA Security Rule for healthcare, GLBA Safeguards Rule for financial services).
• Include regulatory contacts for your industry.
• Reference your sector's threat intelligence sharing group.

For your organization size:

• Small teams: Combine CSIRT roles, pre-identify external forensic support.
• Large enterprises: Add escalation paths for regional incidents, coordinate across business units.
• Public sector: Add ministerial briefing templates, parliamentary question preparation.

For your risk profile:

• High-value targets: Add executive protection procedures if personal data is exposed.
• Organizations holding special category data: Enhance the harm assessment section.
• Critical infrastructure: Include operational technology isolation procedures.

For your legal jurisdiction:

• Replace GDPR references with your applicable privacy law.
• Add local law enforcement contact procedures.
• Include breach notification statute citations.

Validation Steps

Test this runbook before you need it:

☐ Conduct a tabletop exercise with a pure extortion scenario
☐ Verify all contact lists are current (legal, forensics, regulators)
☐ Confirm evidence preservation tools are accessible
☐ Test your 72-hour notification timeline (can you draft and approve in time?)
☐ Review with legal: Are we comfortable with our engagement strategy?
☐ Validate that containment actions won't destroy evidence
☐ Check that your monitoring can detect exfiltration (not just encryption)

Quarterly review triggers:

• Policy changes (like the UK's proposed ransom payment ban)
• New portal or system deployments
• Changes in data classification
• Regulatory guidance updates
• Threat actor tactic shifts (monitor whether extortion-only attacks are increasing in your sector)

The British government reported just four ransomware incidents against central government in the two years following 2023, down from 11 in 2023 alone. Whether that decline reflects better defenses or attackers shifting to pure extortion tactics, you need a runbook that addresses both threats.

Your next data breach might not announce itself with encrypted files and a countdown timer. It might arrive as a quiet message claiming your data is already gone.