A victim notice is one thing; proof of intrusion is another. The gap between those two is where data-extortion campaigns do their most effective damage.