A named victim entry can be an early extortion signal, yet it is not the same as verified breach evidence, which is the key distinction defenders must make.