An extortion note is a threat message used to pressure a target into making contact, paying money, or following instructions. In cybercrime, it often appears after data theft, network intrusion, or file encryption, and may demand payment by a deadline while threatening public release of stolen files, account access, or other sensitive material.
These notes matter because they can create immediate business and reputational pressure even before a compromise is confirmed. Defenders treat them as intelligence signals, not proof: they are checked against logs, endpoint data, cloud activity, and evidence of exfiltration or unauthorized access. Attackers use the note to accelerate decision-making and exploit fear; defenders use verification, containment, and legal or incident-response workflows to separate bluffing from real impact.