A dark web leak site is a website, usually reachable only through Tor, where ransomware or extortion groups publish the names of victims and samples of stolen data to pressure them into paying. If your company appears on one, verify the claim, preserve evidence, and bring in counsel and incident response before anyone replies.
Why do extortion groups run leak sites?
Early ransomware only encrypted files, and good backups let victims refuse. Many groups added data theft. They copy files out first, then encrypt, then threaten to publish. CISA's #StopRansomware guide describes this as double extortion: the pressure no longer depends on whether you can restore.
A leak site is the stage for that threat. It lists a victim, often with a countdown, and posts proof such as file listings or a few documents. If the deadline passes, more data may be released. Some sites also let the public search or download.
MITRE ATT&CK places the theft step under exfiltration (TA0010), which is also where defenders get their best chance to notice something wrong before the listing appears.
Is a listing proof that you were breached?
No, but treat it as serious until you know more. Groups exaggerate. They may reuse old data from a different breach, claim a parent company when only a vendor was hit, or list names with nothing behind them. They also sometimes publish accurate and damaging material.
A constructed example. A mid-size logistics firm sees its name on a leak site with a sample of 40 files. Staff recognize that all 40 share a path from an old file server that was decommissioned two years ago. That points to a supplier migration or an earlier incident rather than a fresh intrusion. It still counts as data exposure, and still needs a response, but the scope question is different.
What should you do in the first day?
- Activate your incident response plan and assign one decision maker.
- Call outside counsel before contacting anyone, so privilege is protected and notification duties are assessed.
- Capture the listing as it appears, with timestamps and URLs. Do not download stolen data to company systems.
- Compare the sample against your records to identify systems, users and data types involved.
- Check logs for large outbound transfers, new admin accounts and unusual tool use around the dates the files were modified.
- Contain what you find: rotate credentials, isolate affected hosts, close the access path.
- Decide who must be told. Depending on the data and location, regulators, customers or insurers may need notice within set time limits.
Should you contact the group or pay?
That is a decision for your leadership, counsel, insurer and law enforcement together. CISA and the FBI advise against paying in their guidance, noting that payment does not guarantee data will be deleted or not used again. Reporting to law enforcement is encouraged, and they may hold information about the group.
Do not communicate with the actors from your own devices or accounts. If negotiation is chosen, specialists should handle it.
How do you reduce the odds of landing on one?
The usual entry points are unpatched internet-facing systems, stolen or weak credentials without multifactor authentication, and phishing. Limit what any one account can reach, so a single compromise cannot copy everything. Watch egress for bulk transfers to unfamiliar destinations. Keep offline, tested backups, which take away the pressure of encryption even though they do not remove the pressure of theft.
How to check or apply this
- Set up monitoring for your company name and domains in public breach and leak reporting.
- Write the first-day list above into a runbook and name the people on each step.
- Run a tabletop exercise where the scenario starts with a leak site listing.
- Map where your most sensitive data lives and who can reach it.
- Test that you can detect large outbound transfers from file servers.
Quick check
Can leaked data be removed from a leak site?
Generally you cannot force removal. Counsel and specialists may advise on takedown requests and on limiting harm, such as notifying affected people and resetting credentials.
Do we need to notify customers if the claim is unverified?
Obligations depend on law and contracts and usually turn on whether personal or protected data was actually accessed. Get counsel to assess as facts come in.
Sources
Last reviewed: 18 October 2026.
