An exposure timer is a posted date and time on an extortion or leak page that claims when stolen data will be published. It is a pressure tactic, not proof. The timer is meant to make the target feel that the threat is real and immediate, even when the attacker has not shown evidence of compromise or data theft.
In real attacks, exposure timers are used to increase leverage during ransomware and double-extortion campaigns. They can push victims to pay, and they can also create reputational damage, confusion, and rushed decision-making inside an organization. For defenders, the timer is a warning signal that should trigger verification: confirm whether access occurred, check for data exfiltration, preserve logs, and coordinate incident response. The key point is to separate the attacker’s deadline from confirmed facts about the intrusion.