More than half of UK organizations struck by ransomware — 58% — paid the demanded ransom, yet 22% of those payers soon faced a second extortion demand, according to a new Proofpoint survey. The findings, published on July 23, 2026, by IT Pro, expose a brutal shift: paying cybercriminals often doesn’t end the attack; it restarts it.

The payment trap: when extortion doesn’t end

The survey of security professionals whose organizations were hit by ransomware found that a majority chose to pay. But the consequences were immediate and damaging. Nearly a quarter of those who paid received another demand — sometimes for more money, sometimes threatening to leak stolen data despite the payment.

This double extortion model has become the norm. Modern ransomware groups don’t just encrypt files; they steal sensitive data, harvest credentials, and plant persistence mechanisms. Payment may get you a decryptor, but it doesn’t verify that stolen data was deleted, that attackers won’t sell it elsewhere, or that they’ve removed all backdoors.

“Paying does not end the incident,” the Proofpoint data underscores. “More than one in five organizations that paid were hit with another extortion demand. This reflects a change in the criminal business model.” Attackers now retain leverage long after the initial ransom, turning a single payment into a recurring revenue stream.

Why a second demand changes everything

For Windows administrators, the traditional ransomware playbook was simple: encrypt, demand, decrypt. That binary choice is gone. When attackers exfiltrate data before locking systems, the stakes multiply. Even if your backups are pristine and you restore everything, the attacker still holds customer records, financial data, or source code.

The survey confirms this pivot: data theft, not just encryption, is now the primary pressure point. A significant proportion of UK respondents reported data was stolen during the attack. That means victims face regulatory exposure, reputational damage, and the possibility of public leaks — all independent of whether they pay.

And paying once doesn’t make the problem go away. Criminal groups may retain copies of stolen data, share it among affiliates, or simply lie about deletion. There is no audit mechanism to verify their promises. Your domain controllers, file servers, and cloud identities may be restored, but the data security incident continues.

AI supercharges the attacks that lead to ransomware

Two-thirds of respondents in the Proofpoint study said artificial intelligence made the ransomware attack more effective. Not because AI somehow improves encryption itself, but because it dramatically sharpens the initial compromise — the phishing, credential theft, and social engineering that give attackers a foothold.

Generative AI crafts fluent, personalized phishing emails at scale, free of the spelling errors and awkward language that once betrayed a scam. The survey found 31% of employees didn’t suspect anything was wrong when they interacted with malicious content, and 24% said attacks succeeded because the messages appeared authentic.

The top attack vectors were malicious links (40%), compromised email accounts (35%), and credential harvesting (32%). In other words, the human layer remains the door of entry, and AI is oiling the hinges.

For Windows and Microsoft 365 environments, this means legacy security awareness training — an annual quiz and a poster — is no longer sufficient. Users cannot reliably detect sophisticated AI-generated lures. Defenses must assume a click will happen and limit the blast radius.

The Windows identity crisis at the heart of ransomware

When ransomware strikes a typical enterprise, it’s rarely just about endpoints. Attackers target Active Directory, the central identity store that governs authentication, authorization, Group Policy, and access to file shares and applications. If they reach domain controller privileges, the incident becomes a full identity compromise.

The survey’s findings on data theft and second extortion underline why identity security is paramount. Attackers can:

  • Dump password hashes and migrate to cloud tokens
  • Create or modify privileged accounts
  • Abuse service accounts with excessive permissions
  • Disable security tools via administrative access
  • Deploy ransomware through centralized management systems
  • Access backups using inherited domain admin rights
  • Establish persistence with scheduled tasks and remote management tunnels

Recovery then exceeds restoring a few encrypted servers. Organizations may need to rebuild or remeidate the entire directory, reset all privileged credentials, revoke tokens, and validate trust relationships — a task that can take weeks without a tested plan.

A ransomware recovery strategy that treats the domain as trustworthy after a compromise is dangerously incomplete.

Breaking the payment cycle: practical defenses for Windows environments

The highest goal is to make payment a non-option by ensuring you can recover without trusting the attacker. That means investing in resilience and tested recovery capabilities.

1. Protect and isolate backups

Backups must be immutable and offline, inaccessible from the production domain. If a compromised domain admin can delete backup jobs or alter retention, you have no safe recovery copy. Maintain multiple copies and regularly test restoration of:

  • Domain controllers and identity services
  • Core Windows Server workloads
  • Virtualization infrastructure
  • Business-critical databases
  • Microsoft 365 data and configuration
  • Security tooling and logging systems

2. Segment your network

Flat networks let ransomware spread in minutes. Isolate administrative pathways from user devices, and segment servers, backups, and sensitive stores. A standard workstation should not have direct access to backup consoles or domain controllers.

3. Harden identity and access

  • Enforce phishing-resistant multifactor authentication (FIDO2, Windows Hello for Business) for all privileged accounts.
  • Use conditional access policies that evaluate device health, sign-in risk, and impossible travel.
  • Implement least-privilege access and just-in-time administration.
  • Maintain separate admin accounts for day-to-day work and privileged tasks.
  • Restrict legacy authentication and tightly control PowerShell, script execution, and macros.

4. Prioritize early detection

Deploy endpoint detection and response (EDR) tools that identify lateral movement, credential dumping, and anomalous activity. Monitor for unusual OAuth consent grants, mailbox rules, and sign-in anomalies in Microsoft 365.

5. Practice incident response

Run tabletop exercises that involve IT, security, legal, HR, and executive leadership. Test scenarios where email is gone, domain controllers are encrypted, and the CEO is being contacted by attackers. Predefine who can authorize a payment (if it ever comes to that) and how to communicate without standard tools.

What the proposed UK payment ban means for your organization

In parallel with these findings, the UK government has been advancing measures to disrupt the ransomware economy. Proposals include a ban on ransom payments by public-sector organizations and critical national infrastructure (CNI) operators, plus mandatory reporting for private firms that do pay.

The logic is sound: removing payout incentives should make public services less attractive targets. But a ban is not a security control. It cannot patch vulnerable systems, rebuild compromised identities, or restore encrypted data. And enforcement is thorny — fining a hospital that paid to restore patient services could worsen an already traumatic event.

The more durable outcome is combining such bans with raised resilience baselines. Organizations that can recover independently won’t face the impossible choice. The proposed mandatory reporting requirement, however, could yield vital intelligence on active groups and techniques, strengthening collective defense.

Outlook: resilience over ransom

The 58% payment rate isn’t a sign of weak leadership; it’s a signal that too many organizations lack the technical and procedural means to recover without negotiating. The 22% second-extortion rate proves that paying does not equal resolution.

Ransomware is no longer just an encryption problem. It is an identity, data, and extortion crisis that thrives when victims believe they have no alternative. For Windows admins and IT leaders, the single most effective countermeasure is to build — and regularly prove — a recovery capability that makes paying irrelevant. The criminals bet on your desperation. Your best move is to ensure that bet fails.