In cyber extortion, a countdown timer is a displayed deadline intended to pressure a victim into making a rapid decision, such as paying a demand or responding to a threat. It may appear on a criminal group’s leak site alongside claims that stolen data will be published when time runs out.
The timer is a persuasion tactic, not proof that data was stolen or that publication will occur. It can disrupt incident response by pushing teams to act before they have verified the claim. Defenders should preserve relevant evidence, investigate the alleged compromise, and coordinate decisions through established security, legal, and leadership processes rather than letting an attacker’s deadline dictate the response.