A ransom claim is a criminal allegation made during an extortion campaign, usually by a threat actor or ransomware group, to pressure a target into paying. It may name a company, website, or dataset and often includes proof-like details such as a hash, screenshot, or file sample.
In cyber security, a ransom claim matters because it is an early signal of possible intrusion, data theft, or simple bluffing. The claim itself does not prove compromise. Defenders should verify the allegation by checking authentication logs, remote access activity, exposed services, backup integrity, and signs of data exfiltration. Early preservation of logs and evidence is important, since response actions or normal retention limits can remove useful traces.