Ransomware is often described as malicious software that encrypts a victim’s files and demands payment in exchange for a decryption key. While that definition is technically accurate, it no longer captures the full scope of the threat. Modern ransomware attacks frequently involve more than encryption. Threat actors may spend days or weeks inside an environment, steal sensitive information, disable security tools, compromise backups, and disrupt business operations before the ransom demand appears. In some cases, attackers may not encrypt anything at all. Instead, they threaten to publish or sell stolen information unless the victim pays. This combination of system disruption, data theft, and extortion has transformed ransomware from a malware problem into a broader business-resilience crisis. CISA’s current ransomware guidance addresses both traditional ransomware and data-extortion incidents because organizations must be prepared for either—or both—to occur during the same attack.