Halcyon Launches Double Extortion Prevention to Stop Ransomware Data Theft Before It Creates Leverage

New endpoint capabilities block known malicious connections and flag anomalous outbound data movement associated with double extortion.

AUSTIN, Texas, Oct. 13, 2026 /PRNewswire/ -- Halcyon, the leading ransomware resilience company, today announced Double Extortion Prevention (DXP), new capabilities designed to stop ransomware operators from stealing data and using it as leverage against their victims.

Ransomware operators increasingly rely on data theft as a second path to payment. Even when an organization can recover from encryption, attackers can still threaten to leak stolen data and use that pressure to force a ransom decision. Double extortion gives attackers two primary ways to pressure victims: encryption and stolen data. Halcyon addresses both. File Resilience (FiRe) targets destructive encryption behavior at the kernel level, while DXP disrupts the data theft attackers use as another path to payment. DXP is delivered directly to the endpoint through the same lightweight agent already deployed across 1,000 customer environments globally.

"Ransomware operators continuously adopt their model. As recovery has improved, attackers have turned to data theft as another way to create leverage and force payment. To change the economics of ransomware, we must take away both forms of leverage: encryption and stolen data. DXP is designed to disrupt the data theft attackers rely on and reduce their ability to pressure organizations into paying a ransom." — Stu Solomon, Chief Executive Officer, Halcyon.

Because Halcyon sees the process, destination, and activity at the endpoint, DXP can take a more targeted approach to exfiltration prevention. When Halcyon identifies a connection to known malicious infrastructure, it can sever that specific connection while allowing the underlying process and other legitimate connections to continue operating. Beyond known malicious infrastructure, DXP also looks for anomalous outbound data movement, flagging transfers that exceed expected thresholds for investigation as potential exfiltration activity. Halcyon's Ransomware Operations Center (ROC) monitors activity and investigates and responds when a suspected data exfiltration attempt occurs.

Halcyon DXP will support Windows, Linux and macOS at launch. To learn more about DXP and Halcyon's approach to double extortion prevention, download the Halcyon Double Extortion datasheet.

About Halcyon
Halcyon is the ransomware resilience company purpose-built to protect organizations across the full ransomware attack lifecycle, from pre-execution to data exfiltration and encryption. Its platform combines ransomware-native prevention, rapid recovery, and a 24/7 operations center to help organizations detect, disrupt, and defend against ransomware.

Learn more at halcyon.ai.

SOURCE Halcyon