A public victim listing can be an extortion tactic on its own, and in this case the available evidence supports caution before any claim of confirmed breach, theft, or outage.