A leak note is a claim, usually posted by a threat actor, that files, records, or other data were taken and may be released unless demands are met. It is a pressure tactic, not proof. The note may name a victim, mention a file count, or include a publication deadline to make the claim look credible.
In cyber security, leak notes matter because they can trigger panic before any breach is verified. Defenders should treat them as intelligence, not evidence: check logs, validate whether data access occurred, and confirm whether any sample files are real. A leak note can be part of ransomware, extortion, or data-theft operations, where the attacker uses the threat of disclosure to force payment or attention. Separating the message from the facts helps teams respond accurately and avoid overstating the impact.