Extortion signaling is messaging meant to pressure a target before the evidence is fully verified. In cyber security, it often appears as a victim post, ransom note, teaser, or public claim that suggests data theft, encryption, or disruption without proving it. The goal is to create urgency, reputational damage, and negotiation pressure.
This matters because defenders, executives, and customers can react to a claim before logs, alerts, and internal reports confirm what actually happened. Attackers use extortion signaling to amplify fear and force a response, while defenders use verification to separate propaganda from real incident activity. Good practice is to treat the signal as an indicator, not proof, and compare it against telemetry, endpoint evidence, backups, and user reports before making decisions.