Hackers exfiltrate data first before encrypting it to increase their bargaining power during ransom negotiations.  Threats of public exposure of private information accelerate up the urgency for victims to pay a ransom immediately. Secureworks Counter Threat Unit researchers are tracking the INC Ransom group known as GOLD IONIC.  INC Ransom Group Exfiltrate Data Emerging in August 2023, this threat group employs double extortion tactics – exfiltrating data before encryption, then threatening public exposure to pressure victims into paying ransoms.

Source: GBHackers