When Attackers Steal Your Data, What Have They Actually Stolen?

Imagine this scenario.

An attacker gets into an organization’s network. They move laterally, find valuable file shares, copy large volumes of confidential information, and leave with it.

Then comes the message:

Pay us, or we publish your data.

This is no longer an unusual ransomware tactic. The Cybersecurity and Infrastructure Security Agency (CISA) describes how ransomware groups increasingly combine disruption with data theft and threats to publish stolen information, often called double extortion. In some incidents, the data-theft threat itself is the extortion mechanism, even without encrypting the victim’s systems. 
 

At that point, backups alone do not solve the problem. The organization may be able to restore its systems, but the attacker already has a copy of the information.

The crucial question becomes:

Was the stolen data readable?

A breach does not have to mean immediate disclosure

There is an important distinction between an attacker obtaining a file and an attacker being able to use the information inside it.
If sensitive files are stored in plaintext, copying them may be enough to create a confidentiality breach.

Persistent file encryption changes that equation.

Utimaco LAN Crypt File and Folder Encryption performs client-side file-level encryption and is designed so that protected files remain encrypted when stored, transferred, shared or backed up. Encryption happens transparently for authorized users, while the protected data remains ciphertext outside the authorized context. 

So if an attacker exfiltrates the encrypted files from a storage location but does not obtain authorized access to the corresponding keys or plaintext, what they have taken is fundamentally different:

encrypted data rather than immediately readable business information.

That does not make the intrusion harmless. Systems may still be comprom

ised, operations disrupted, and incident-response obligations triggered. But from a confidentiality perspective, persistent encryption can significantly change the impact of stolen files.

Encryption immediately raises another question: where are the keys?

Encryption is only as useful as the protection and governance of the keys that control access to the plaintext.
If sensitive data and the keys required to decrypt it live inside the same compromised environment, an attacker may be able to target both.

This is why separating key custody from data storage matters.

LAN Crypt can integrate with Utimaco Enterprise Secure Key Manager (ESKM), allowing file and folder encryption keys to be centrally managed across their lifecycle while remaining separated from the encrypted data. ESKM provides policy and access controls around those keys and supports centralized management across on-premises and cloud environments. 
Even for deployments requiring highest security levels protection, Utimaco’s ESKM provides hardware-backed key protection through embedded General Purpose HSM technology, providing a hardened cryptographic boundary for sensitive key material. 
 

The architecture then becomes simple:

• LAN Crypt protects the files.
• ESKM governs the keys.
• The HSM strengthens protection of the critical key material underneath.

Why hardware protection matters

Suppose an organization encrypts its most sensitive engineering documents.

An attacker steals the encrypted repository.

So far, the encryption is doing its job.

But the attacker’s next target is obvious: the encryption keys.

If critical key material is exportable from an ordinary software environment, compromise of that environment may also expose the cryptographic authority protecting the data.

An HSM changes that trust boundary. Encryption keys can be protected and cryptographic operations performed inside dedicated hardened hardware, ensuring strict separation of the  key material from the encrypted data and the application environment.
 

That does not mean an HSM makes misuse impossible. An attacker who compromises an already-authorized endpoint or obtains legitimate access may still be able to reach plaintext or request permitted operations.

But it removes a dangerous assumption:

Separating keys from encrypted data reduces the risk that a data storage compromise becomes a data exposure: stealing the files should not automatically give an attacker the cryptographic keys to read or misuse them.

Encryption without Key Security doesn't form a reliable cybersecurity

Encryption is one layer of a broader cybersecurity strategy. Its role is not to prevent every attack, but to reduce the impact if an attacker reaches or steals sensitive data. Persistent file encryption can keep exfiltrated files unreadable outside an authorized context, while secure key management helps ensure that access to the data does not automatically mean access to the keys that protect it. An HSM strengthens this separation by protecting critical key material within a dedicated hardware trust boundary. 
 

These controls work alongside IAM, endpoint security, DLP, monitoring, backups and incident response. If an attacker compromises an already-authorized endpoint while data is legitimately decrypted, they may still be able to access plaintext. 

So, the objective is not to make breaches impossible. It is to limit what a successful breach can become, and to make stolen data significantly harder to use.

Cybersecurity should assume that prevention may eventually fail somewhere. The architecture should then ask:

• If attackers reach our storage, do they automatically reach our information?
• If they steal our files, can they read them?
• And if they compromise one environment, do they also obtain the cryptographic keys protecting everything inside it?

Make stolen data less valuable

Modern extortion works because stolen information has value.

The security goal should therefore not stop at preventing attackers from entering the network. Organizations also need to reduce the value of what an attacker can take if another control fails.

Persistent encryption, independent key management and hardware-backed key protection create layers between:
access to infrastructure
and
access to readable information.

That separation can make the difference between an attacker leaving with confidential business data, and leaving with ciphertext they still cannot meaningfully use.

Because the best time to think about whether stolen data is readable is before someone steals it.

Strengthen your ransomware resilience beyond backup and recovery. Explore LAN Crypt for persistent file and folder encryption, Enterprise Secure Key Manager for centralized key control, and Utimaco General Purpose HSMs for hardware-backed protection of critical encryption keys.

About the Author

Amani Karchoud

Product Marketing Manager, Utimaco