An extortion post is a source like any other. It has an author with motives, a track record that can be checked and content that can be tested. The mistake is to treat it as a notification.
A claim is a source, so grade it
Under the grading system we apply to every source, a new leak post starts at F6: reliability cannot be judged, truth cannot be judged. Everything that follows is an attempt to move it, in either direction, on evidence.
That framing matters under pressure. The author of the post wants it read as fact, and the countdown exists to prevent the reader from checking. A team that reminds itself it is holding an ungraded claim from a hostile source makes better decisions in the first hour than one that believes it has been told what happened.
The first hour: preserve
Leak sites are edited, taken down and relaunched without notice. Before analysis, capture everything that is publicly offered and hash it.
- The listing itself, including the page source and any countdown.
- The file tree, if one is published. This is often more informative than the samples.
- The sample archive, exactly as offered.
- The actor's other listings and any earlier versions of this one held in web archives.
Our guide to evidence handling covers what a defensible capture contains. One point is specific to this work: samples frequently contain personal data about people who are not party to the dispute. Access should be limited to the analysts who need it, and nothing should be copied beyond what verification requires.
Five questions to ask of the sample
When was it made?
Check creation and modification dates, and then check what the content itself implies: letterheads, product names, staff lists, software versions. An intruder with live access almost always has recent files. A sample in which nothing is newer than two or three years old is telling you where to look next.
Whose systems produced it?
Folder structures, file naming conventions and export formats belong to particular systems. Material from a supplier's document platform looks different from material taken from a file share. Your own administrators can usually say within minutes whether a folder tree is theirs.
Has it been seen before?
Compare file names, sizes and hashes against indexes of data sets that have already circulated. This does not require holding the old data. An index is enough to show that a "new" archive is an old one with a new label.
Is any of it public?
Brochures, tariff schedules, regulatory filings and marketing material are commonly added to make a sample look larger. Their presence says nothing about a breach and a good deal about the seller.
Does it contain what only an intruder would have?
Work with the responders to list file types that exist nowhere outside the organization's own systems. Their absence across a large sample and file tree is strong evidence. Their presence changes the picture immediately.
Five questions to ask of the seller
- How old is the persona? A leak site or account that appeared a few months ago has no reputation to protect.
- What happened to its earlier claims? Check previous victim posts against known leaks. A record of recycled data is the best predictor of more.
- What else does it sell? Intrusion crews and data resellers are different businesses. A handle that also sells old credential lists is usually the second kind.
- Who vouches for it? Established criminal communities police fraud against their own members. A seller with no standing in them is often avoiding scrutiny.
- How does the money move? Public ledgers show whether the published payment addresses have ever received meaningful sums.
What the file tree tells you
Headline volumes are chosen to frighten. A published tree of file names lets you measure the claim without downloading its content. De-duplicate it. Remove public documents. Group what remains by origin system and by date. In a recent case, a claimed four terabytes reduced to about 310 GB of unique material, almost all of which had circulated since an earlier breach at a third party. The full account is in The breach that was not.
Four things not to do
- Do not buy the data to check it. Payment funds the next attempt, may be unlawful and tells the seller the claim has landed. We never do it, for any client.
- Do not open a negotiation as a test. Engagement confirms that the right people are reading and resets the seller's expectations.
- Do not confirm or deny in public until you know. A premature denial that proves wrong does more damage than a day of silence.
- Do not let the countdown set the pace of the analysis. Set your own decision points and tell the crisis team when each answer will be available.
Four possible answers, four different responses
| Conclusion | Typical evidence | What follows |
|---|---|---|
| Fabricated | Public documents only, no organization-specific content | No engagement. Monitor. Brief staff and customers if the post is circulating. |
| Recycled | Samples match a previously circulated data set | Confirm earlier notifications covered it. Factual statement. Targeted validation only. |
| Third party | Structure and content of a supplier's systems, recent dates | Engage the supplier. Assess your own notification duties with counsel. |
| Genuine and recent | Recent files of types unique to your systems | Full incident response. Verification continues, to establish scope and actor. |
In the first nine months of 2026 we were asked to verify 51 claims. Twenty were recycled or fabricated. Twelve traced to a third party. Nineteen were genuine and recent. Nothing about the original posts distinguished one group from another. The frightening ones and the empty ones used the same words.
Reporting when you cannot be certain
Open sources cannot prove that a criminal holds nothing more than they have shown. A verification report has to say that, and then say what would change the assessment. We name specific tripwires, such as any published file dated after a given month or any file of a type unique to the client, and we watch for them until the deadline passes.
The sample data very likely originates from the 2022 breach of a third party and not from the client's network (high confidence). This judgment rests on exact hash matches for 222 of 312 sample files, the folder structure of the published tree and the absence of any file modified after February 2022. We cannot exclude that the actor holds unpublished material.
What to arrange before it happens
Verification is faster when three things already exist: a named person with authority to commission it at any hour, a list of file types unique to your systems, and an agreed rule that nobody responds to an extortion post until the claim has been graded. None of them costs anything to prepare.