A leak timer is a deadline announced in ransomware extortion to pressure a victim before allegedly stolen data is published. It is usually shown on a disclosure page or leak site as a countdown, sometimes called a “full data timer.” The goal is to force fast payment, negotiation, or public response by creating urgency around an unverified claim.
In practice, a leak timer matters because it can shape incident response even when the breach details are still unclear. Defenders should treat it as a threat signal, not proof of data theft. Security teams use the timer to trigger validation steps: check for intrusion evidence, confirm whether sensitive data was accessed, and prepare communications and legal review. Attackers use it as psychological leverage; defenders use it as a prompt to verify facts before the countdown drives decisions.