Data-leak activity is the threat or act of publishing stolen data to pressure a victim. In extortion and ransomware cases, operators may threaten to expose or actually release files, credentials, contracts, or internal documents unless payment is made. The goal is leverage: even if encryption is restored from backups, the risk of public disclosure can still force a response.
This matters because it turns a compromise into a privacy, legal, and business crisis. Defenders watch leak sites, negotiation portals, and other publishing channels to confirm what was stolen, assess impact, and prepare notifications. They also track the infrastructure used to host or distribute leaked data, since moving these services to decentralized or harder-to-remove systems can make disruption and takedown more difficult.