A leak-site appearance can be enough to trigger operational alarm, but it still needs verification - especially when the alleged prize is a client database that may be more sensitive than it first appears.