In February 2026, a ransomware attack hit the University of Mississippi Medical Center (UMMC). This event disrupted their Epic electronic health record system at 35 clinics and over 200 telemedicine locations, leading to canceled chemotherapy sessions and delayed elective surgeries. Healthcare professionals had to switch to manual, paper-based methods, impacting numerous patients.

UMMC is not alone. Recent statistics show that 93% of U.S. healthcare facilities experienced at least one cyberattack in 2025, with 72% reporting disruptions to patient care as a result.

The manufacturing and finance industries are also vulnerable. In February 2026, a ransomware attack on BridgePay’s payment network took down their APIs, virtual terminals, and payment portals. Across all sectors, publicly reported ransomware attacks rose dramatically by 49% in 2025, totaling 1,174 incidents.

With hospitals suspending treatments, financial organizations halting transactions, and factories ceasing operations, ransomware has become a clear and present business risk with significant operational repercussions.

Initial ransomware attacks were basic: infiltrate, encrypt, and demand payment for the decryption key. When organizations started using backups for recovery, attackers evolved to a more profitable strategy: double extortion.

In double extortion, hackers first steal confidential files, like patient data and billing information, and then encrypt the system. Victims face a double threat: pay to unlock the data or risk having it exposed publicly.

Backups aren’t enough to defend against this. Since the attackers already have the data, refusal to pay can lead to sensitive information being leaked, causing substantial financial and legal problems.

The cyber threat is still growing, with triple extortion becoming more common, where attackers directly contact the victim’s clients or associates to apply extra pressure.

In 2025, 124 active ransomware groups were identified, including 73 new ones.

The spread of AI tools has simplified cybercrime, making ransomware more accessible to less skilled attackers.

The rise of multi-extortion ransomware calls for a new approach to security that goes beyond basic perimeter defense.

Organizations require a security strategy that protects data from being used against them after a breach. This includes rendering leaked data unreadable, preventing ransomware from accessing files initially, and ensuring quick recovery when attacks succeed.

D.AMO, created by Penta Security, is an advanced platform designed to combat all phases of a multi-extortion ransomware attack. It features integrated data encryption, access management, and backup recovery for both on-site and cloud-based systems.

By implementing file encryption and process-level access controls, D.AMO safeguards critical data on servers and PCs by controlling unauthorized access and protecting sensitive data from malicious software. D.AMO’s main features are:

Folder-Level File Encryption

D.AMO KE encrypts every file within designated folders at the operating system level. It can be implemented via an installer without altering the source code and uses kernel-level encryption technology for fast and reliable encryption without impacting user experience.

Encryption policies are applied at the folder level, ensuring consistent protection with reduced operational costs. Importantly, even if an intruder extracts sensitive data, the files remain encrypted, countering the data exposure threat in double extortion.

D.AMO KE uses stringent access controls for processes and OS users, granting access only to authorized users. Ransomware and other harmful programs are automatically prevented from accessing encrypted folders, averting unauthorized file alterations.

All blocked activity is tracked and centrally reviewed using D.AMO Control Center.

Even if an attack occurs, organizations can continue functioning through a separately managed recovery system. With D.AMO, the ability to recover from backups eliminates much of the need to negotiate decryption keys with attackers.

As multi-extortion strategies grow in popularity, the ability to prevent attackers from exploiting stolen data has become a priority. Organizations need to ensure that downloaded data is unusable, block ransomware from accessing files, and recover quickly after incidents.

D.AMO addresses each phase of a ransomware attack comprehensively within a single suite, integrating encryption, process-based access control, and backup recovery into a complete defense strategy.

Want to learn more? Download the D.AMO Data Sheet.

Sponsored and written by Penta Security.