An extortion workflow is the sequence of pressure tactics attackers use to coerce a victim. It usually combines a public or private threat, a victim listing or proof of access, a deadline or countdown, and repeated demands for payment or other concessions. The goal is not only to steal data, but to create urgency, uncertainty, and reputational risk.
This matters in cyber security because the workflow itself is part of the attack. Even when the technical breach details are unclear, the public posting and timer can force rapid decisions, distract teams, and increase the chance of mistakes. Defenders should treat these events as active incidents: preserve evidence, verify exposure, coordinate legal and communications response, and avoid reacting without confirming the scope of the compromise. Recognizing the pattern helps separate a pressure campaign from the underlying intrusion and supports a more disciplined response.