A leak-site posting can be an extortion signal, a bluff, or a warning shot - but on its own, it is not proof of stolen data or confirmed compromise.