double extortion

Capcom Ransomware (2020) — Why an Old VPN Device Was the Way In, and the Double-Extortion Defense

The way in was an old backup VPN device that had been left running at a North American subsidiary after newer units replaced it. From there the network was breached, data was stolen, and then ransomware encrypted systems (double extortion). Up to ~390,000 people's personal data was potentially exposed (no payment-card data). Capcom refused to pay, restored from backup, and disclosed transparently. Defend by decommissioning unused gear, patching edge devices, and covering both theft and encryption (segmentation, detection, backups).