A victim label on a ransomware extortion site is not proof of breach, but it is enough to trigger a serious security response for any heritage institution.