A leak-site listing is not proof of breach, but it is a warning sign that a ransomware crew is applying public pressure while defenders still need to verify the facts.