A Tor leak site is a hidden-service page hosted on the Tor network and used by extortion crews to publish stolen files, pressure victims, or post ransom demands. Because it is reachable through .onion addresses and not normal web search, it gives attackers a measure of anonymity and makes takedown efforts harder.
In ransomware operations, a leak site is part of the coercion strategy: if the victim does not pay, the group threatens to expose data there. For defenders, the site is also a source of intelligence. Changes in naming, address patterns, posting style, and timing can reveal infrastructure overlap, but they do not by themselves prove common control or shared tooling. Security teams use these pages to monitor disclosures, validate claims, preserve evidence, and track threat clusters while keeping attribution separate from initial observations.