Victim notification is the act of naming a target in a ransomware or extortion context, usually on a public leak site, chat channel, or threat actor post. The notice may include the company name, sector, location, and sometimes a deadline or “countdown” meant to increase pressure. It is a form of psychological and reputational leverage, not proof that data was stolen or published.
This matters in cyber security because public naming can force a response before the full technical picture is clear. Defenders use victim notifications to trigger validation steps: check logs, confirm whether access occurred, assess data exposure, and coordinate legal, communications, and incident response actions. In real attacks, the notification is often designed to amplify urgency, distract teams, and push payment negotiations. A posted victim name should therefore be treated as an indicator to investigate, not as confirmation of breach by itself.