A leak-site style extortion claim can signal serious risk even when no encryption is confirmed, especially for organizations that hold sensitive client records.