An extortion threat is a pressure campaign in which an attacker claims to hold stolen data, or says they do, and demands payment, contact, or another concession. The goal is leverage: create urgency with a deadline, a leak warning, or a public post that increases reputational damage if the target does not respond.
In cyber security, extortion threats matter because they can appear even when the underlying breach is unconfirmed. Attackers may use real exfiltrated files, partial screenshots, or bluffing to force a response. Defenders should treat the message as a security event: verify the claim, preserve logs, review bulk downloads and account activity, isolate affected systems, and rotate credentials or keys if exposure is plausible. Rapid evidence handling reduces the attacker’s leverage and helps determine whether the threat is empty, noisy, or tied to real data theft.