The extortion cycle is the pressure phase of a ransomware or data-extortion campaign. After an organization is named or threatened, attackers use public claims, countdowns, sample leaks, and demands for contact to force a response. The goal is not only payment, but also urgency: make defenders react before they can fully validate what happened.
This matters because the cycle can shape decisions as much as the intrusion itself. A victim listing may appear before compromise is confirmed, creating reputational and operational pressure. Defenders should verify evidence, check exposed systems and access paths, preserve logs, and coordinate legal and communications teams before responding. In real attacks, the extortion cycle often includes repeated publication updates, deadline resets, and threats to release data until the target negotiates or proves the claims false.