A data sample is a small set of files, records, or screenshots shared to prove that an attacker claims to have stolen data. In extortion campaigns, the sample is meant to persuade the victim that the breach is real and that more data may be available.
Data samples matter because they can change a situation from a vague threat into a concrete incident response problem. Defenders use them to check whether the exposed material matches internal systems, assess what information may have been accessed, and decide whether containment, legal review, and notification steps are needed. Attackers may also edit or recycle samples, so the presence of a sample is not proof of full compromise. Security teams should validate hashes, metadata, file contents, and access logs before accepting the claim at face value.