A public victim post can be an extortion signal, a reputation strike, or both - but it is not, by itself, proof of a breach.