Perspective as CEO of a backup and disaster recovery company...

A lot of folks now have ransomware protected backups for critical data so they aren't paying for decryption keys.

This has escalated to hack and release, the attackers are now exfiltrating data and threatening to make it public in addition to encrypting it on the host system.

>> If they're going to publish the data publivally, what do you need decryption keys for?

Because they will publish the bad stuff, the stuff you really don't want public, but likely withhold the boring stuff, the stuff the business really needs to function. And whatever they release might not be in the format that it was taken.

They only tell you about the second extortion attempt after the success of the first. As I understand it, each gang operates differently, but most are consistent in their approach (e.g. x will always double ransom, but y will never).

I think that's why you ransom the decryption key first. If I understood correctly.