An extortion signal is a public clue that may indicate pressure in a ransomware or data-theft case, but it does not prove a breach on its own. Examples include a victim listing, a masked organization name, a countdown note, or a claim that data will be released if demands are not met.
In cyber security, these signals matter because they can appear before an organization has confirmed any compromise. Defenders use them to trigger verification steps such as log review, endpoint checks, identity monitoring, and legal or incident-response coordination. The key is to treat the signal as a warning, not as evidence of the full attack. Public claims can be exaggerated, incomplete, or even false, so teams should separate reputation risk from confirmed technical facts.