A leak site is a public web page used by threat actors to pressure victims during extortion. Instead of keeping stolen files private, attackers may publish a victim’s name, screenshots, samples of documents, or other data on the page to signal that compromise is real and to force a faster response. In ransomware operations, the leak site is often part of the negotiation strategy.
Leak sites matter because the public claim itself can cause damage before technical facts are confirmed. Security teams use them as threat intelligence sources, but they also treat them cautiously: a posted name does not always prove a breach. Defenders should verify the claim with logs, endpoint telemetry, data-loss indicators, and backup status, while also tracking exposed brands, domains, and stolen-file samples. Monitoring leak sites helps organizations assess exposure, but the strongest defense is still to confirm whether access, exfiltration, or encryption actually occurred.