A sparse new extortion brand, a managed IT provider, and an unverified data-theft claim show how quickly leak-site pressure can become a security event on its own.