Why does a modern ransomware crew exfiltrate data before encrypting it?

Question

Accepted Answer

Because the stolen copy is the second extortion lever — it still works even if the victim restores from backup.
The sequence is deliberate: exfiltrate first, encrypt second. Exfiltration (copying data out to an exfil server) sets up double extortion — the threat to leak the data. If they encrypted first and the victim simply restored backups, the attacker would have no leverage left. By stealing the data beforehand, they keep a hold over the victim regardless of backups.
Detection angle: large outbound data transfers to unfamiliar destinations are a red flag — egress monitoring / DLP can catch the exfiltration stage, which happens before any visible damage.
Tip: Order of operations tells you the attacker's business model: theft-then-encryption = they plan to extort you twice (pay to decrypt and pay to prevent the leak).
Go deeper:

Ransomware (Wikipedia) — leaking stolen data preserves leverage even against victims who can restore from backups.
 Conti (Wikipedia) — a crew that runs a leak site to pressure victims with the published-data threat.