A public extortion claim against Spedidam and spedidam.fr is a reminder that leak-site chatter is not proof, but it can still point defenders toward exposed authentication, web, and recovery surfaces.