An extortion demand is a payment request backed by a threat, usually to publish stolen data, leak access, or intensify pressure on the victim. In cyberattacks, it is the negotiation phase of ransomware and data-theft extortion, where criminals try to turn unauthorized access into leverage.
This matters because the demand itself can be used as a weapon, even before any compromise is fully confirmed. Threat actors often add deadlines, sample files, or public claims to create urgency and force rushed decisions. Defenders should treat the message as unverified until incident triage checks logs, affected systems, and evidence of data loss. A disciplined response helps avoid paying based on bluff, while still preparing for containment, legal review, and communications if the claim is real.