A public victim listing can be only a claim, but it still signals how extortion crews target media workflows where timing, trust, and files matter as much as endpoints.