Scope uncertainty is the gap between an early public claim about an incident and the actual, verified extent of compromise. In ransomware and extortion cases, a leak-site post may name a victim, show a sample of data, or make broad allegations, but it often leaves unanswered questions about what systems were accessed, how much data was taken, whether backups were touched, and whether partners were affected.
This matters because defenders need to separate signal from speculation. Treating an unverified post as the full story can waste effort, while dismissing it can delay containment. In practice, scope uncertainty shows up in the first hours of an intrusion when logs are incomplete, forensics are still in progress, and attackers use public pressure to force payment. Good defense means validating the claim, checking identity and access logs, reviewing exfiltration evidence, and mapping possible supplier or downstream impact before making conclusions.