The extortion phase is the pressure stage of a ransomware or data-theft campaign, when attackers try to force a response from the victim. Instead of focusing on stealth or initial access, the goal is to create urgency through public victim listings, threats to leak data, or demands for payment. The “pressure” may be aimed at executives, legal teams, insurers, or incident responders.
This phase matters because the public claim is not proof of the full intrusion. A listing or leak site post may be meant to shape perception before defenders finish triage and verification. In real incidents, teams should treat extortion claims as indicators, then check logs, privileged access activity, backup integrity, remote access paths, and signs of data movement. Good defenses include rapid evidence preservation, tight containment, clear communications, and validation before responding to attacker demands.