A leak sample is a small excerpt of data that a threat actor publishes or shares to support a claim that stolen information exists. The sample may include filenames, emails, spreadsheets, screenshots, or fragments of sensitive records. In extortion campaigns, it is used as proof-of-access: if the sample looks real, the target may feel pressure to respond quickly.
For defenders, a leak sample matters because it can reveal what type of data was exposed, help verify or refute an attacker’s claim, and guide incident response. However, a sample alone does not prove the full scope of compromise, the intrusion method, or whether the data was obtained recently. Security teams should preserve evidence, compare the sample to internal records, and treat the claim as a prompt for careful investigation rather than a final conclusion.