A public victim post can be an extortion signal, but it is not the same thing as verified compromise, and that distinction matters for retailers under pressure.