An extortion timer is a deadline announced in a ransomware or data-extortion campaign to raise pressure on the target. It may be shown on a victim page, in a chat message, or in an email threat, often paired with claims that stolen data will be published, sold, or deleted when the timer expires. The purpose is psychological as much as technical: it pushes defenders to react quickly, sometimes before they have fully verified what happened.
In practice, an extortion timer can shape incident response by forcing rapid triage, legal review, and communications planning. Defenders should treat it as a pressure tactic, not proof of compromise. The right response is to validate the claim, preserve evidence, assess whether data exposure is real, and avoid making decisions based only on the countdown. Attackers use these timers to intensify fear; defenders use verification to keep the incident grounded in facts.