A data leak site is a public pressure channel used by ransomware and extortion groups to name organizations they claim to have compromised, publish stolen files or samples, and threaten further disclosure. Files generally reach a site only after attackers gain access to a victim’s environment and transfer selected data out. A listing is a group’s claim—not, by itself, proof of the full breach or everything stolen.
What is a data leak site?
A data leak site (DLS) is a web publication channel that extortion actors use to make threats visible. A group may name an organization, show a sample of allegedly stolen data, threaten to publish more, or claim that files have been released. The public exposure is meant to increase pressure on the organization to pay or otherwise respond.
As an Amazon Associate I earn from qualifying purchases.
CISA notes that such sites can display names and captured data, or list victims that have only been threatened with a leak. In other words, a listing does not necessarily mean that the group has published the organization’s data.
How do stolen files end up on a data leak site?
The broad sequence is access, discovery, data transfer, and pressure. The details differ by actor and incident; there is no universal timetable or workflow.
#1 Best Overall
- Gain access: Attackers first obtain a foothold in an organization’s systems.
- Identify useful information: They explore the environment and select data they believe could give them leverage.
- Move data out: They transfer selected files from the victim’s environment to infrastructure or services they control or can access.
- Make a demand or threat: They may privately demand payment, publicly list the organization, post a sample, or threaten further disclosure. Some groups use countdowns or threaten to sell data, but those tactics and the timing vary.
CISA’s ransomware guide names Rclone, Rsync, web-based file storage services, and FTP/SFTP among tools or services commonly used for exfiltration. These are examples, not a universal toolkit. The key point is that publication usually follows a separate data-transfer stage; files do not simply appear on a leak site because systems were encrypted.
Does every ransomware attack encrypt files?
No. Double extortion combines data theft and a threat to publish or otherwise expose the data with encryption of the victim’s systems. But some extortion incidents rely on data theft and disclosure threats without encrypting files. Conversely, the precise mix of theft, encryption, private demands, and public claims depends on the actors and incident.
One example: Play ransomware
A joint advisory from the FBI, CISA, and Australia’s ASD’s ACSC describes Play actors as using a double-extortion model: they exfiltrate data before encrypting systems, then threaten to publish the stolen information on a Tor network leak site if the victim refuses to pay. This describes Play’s reported practice, not a template for every ransomware group.
Recommended Free Tools
The advisory says the FBI was aware of approximately 900 entities allegedly exploited by Play actors as of May 2025. That is the FBI’s approximate figure for entities allegedly exploited by that date; it is not a current count or a confirmed count of organizations whose data was publicly disclosed.
Does a company listing prove what was stolen?
No. A group-controlled site establishes that the group made a claim. A posted sample may show that the group had access to some files, but it does not by itself establish the full scope of a breach, verify every assertion, or prove that all threatened data was released.
Listings can also be incomplete. CISA’s LockBit advisory says that the site showed only victims subjected to secondary extortion. Some victims may never be named or posted, so the site is not a reliable way to establish attack dates or count all victims. A list should not be treated as a complete, independently verified record of breaches.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What should an organization do if it is threatened?
If you are assessing a public claim
- Avoid visiting the leak site or downloading material from it.
- Check the organization’s official notices and consult relevant authorities for verified information.
- Distinguish what the group claims from what the organization or authorities have confirmed.
If your organization is affected
The FBI advises affected organizations to contact a local FBI field office or report through the Internet Crime Complaint Center (IC3). IC3 asks complainants to preserve details such as the ransomware variant, if known; the encrypted-file extension; cryptocurrency information; the attacker’s email; supplied website URLs; the demand amount; and whether and how much was paid.
For preparation, the FBI recommends keeping operating systems, software, and applications current; regularly updating anti-malware tools; maintaining verified backups separate from the systems they protect; and having a continuity plan. A disconnected external drive can be one way to store a backup, but backup storage alone does not prevent attackers from stealing data.
Best Value
The FBI says that paying a ransom does not guarantee that an organization will get its data back and does not support paying. Its guidance focuses on preparation, reporting, and recovery rather than treating payment as a reliable solution.
Quick Recap
Sources
- CISA, Ransomware Guide
- CISA, LockBit Ransomware
- FBI, CISA, and ASD’s ACSC, Play Ransomware
- FBI, Ransomware
- FBI Internet Crime Complaint Center (IC3)
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
