A Tor-based leak portal is a hidden-service website hosted on the Tor network and used to publish stolen files, extortion notes, or pressure messages. Because Tor hides the server location and traffic path, the operator can run the site with greater anonymity than on the clear web.
In ransomware and data-theft campaigns, these portals are part of the coercion model: attackers threaten to expose data unless demands are met. For defenders, the portal can provide useful signals, such as victim listings, file samples, contact details, and changes in operator behavior. An inactive portal does not mean the threat is gone; it may reflect setup delays, shifting infrastructure, or a pause before public pressure resumes. Monitoring these sites helps analysts track attribution, spot reused infrastructure, and understand how a criminal group communicates with victims.