A data leak site is a public-facing channel ransomware and extortion groups use to name organizations they say they have compromised, publish stolen files or samples, and threaten further disclosure to pressure victims. Files typically reach a site only after attackers gain access to an organization’s systems and transfer selected data out; the site is the public part of an extortion campaign, not where the theft begins.
What is a data leak site?
A data leak site (DLS) is a publication channel controlled by an extortion group. It may identify a targeted organization, show sample files, claim that data was stolen, or threaten to publish or sell it. The threat is intended to increase pressure on the organization to pay.
Some groups use a site to publish material; others may list a victim or make a threat without posting files. CISA notes that a listing can refer to a victim threatened with a leak, not necessarily a completed public release. A group-controlled page records what that group claims, but it is not by itself independent verification of the breach or its full scope.
How do stolen files end up on a leak site?
The basic chain is access, collection, transfer, and pressure. Details vary by incident, and there is no single schedule or universal toolkit.
#1 Best Overall
- Gain access: The actor gets into part of the victim’s environment.
- Look for useful data: The actor explores accessible systems and identifies files that could provide leverage.
- Transfer data out: Selected material is copied from the victim’s environment to a location the actor controls or can access.
- Make a demand or public threat: The actor may contact the organization privately, list it publicly, post samples, or threaten broader disclosure.
- Publish or withhold material: Depending on the group and incident, files may be released, offered for sale, or never publicly posted.
CISA’s ransomware guide names Rclone, Rsync, web-based file storage services, and FTP/SFTP among tools or services commonly used for exfiltration. These are examples, not a checklist used in every attack. The important distinction is that exfiltration—the transfer of data out—must occur before stolen files can be published.
Does every ransomware attack encrypt files?
No. In a double-extortion attack, the attackers use both data theft and the threat of publication, and also encrypt systems or files. Some extortion campaigns rely on stolen data without encrypting systems. The combination of tactics depends on the group and the incident.
Example: Play ransomware
A joint advisory from the FBI, CISA, and Australia’s ASD’s ACSC describes Play actors exfiltrating data before encrypting systems, then threatening to publish the information on a Tor network leak site if the victim does not pay. The advisory says the FBI was aware of approximately 900 affected entities allegedly exploited by Play actors as of May 2025. That is the FBI’s approximate figure for entities allegedly exploited by that group at that time—not a confirmed count of organizations whose data was publicly leaked or a current total. See the joint Play ransomware advisory.
Does a company’s listing prove what was stolen?
No. A listing shows that the group made a claim; it does not establish every detail of that claim. A posted sample may indicate that the actor had access to some files, but it does not by itself prove the full scope, the authenticity of every asserted file, or that all threatened data was released.
Listings are also incomplete. In its LockBit advisory, CISA explains that the group’s site shows only victims subjected to secondary extortion. Some victims may be threatened but not named, or never appear on the site. As a result, the site cannot reliably establish the total number or timing of attacks.
If you encounter a claim about an organization, avoid visiting the site or downloading purported stolen files. Check the organization’s official notices and relevant authorities for what is known; a group’s page should not be treated as a complete or independently verified breach record.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What should an organization do if it is threatened?
For an organization facing a ransomware or extortion incident, preserve relevant information and contact authorities. The FBI advises affected organizations to contact a local FBI field office or report through the Internet Crime Complaint Center (IC3). IC3 asks complainants to retain details such as the ransomware variant if known, encrypted-file extension, cryptocurrency information, attacker email, supplied website URLs, demand amount, and whether or how much was paid.
Prepare for disruption before an incident as well. The FBI recommends keeping operating systems, software, and applications current; maintaining regularly updated anti-malware tools; keeping verified backups disconnected from the systems they protect; and having a continuity plan. A disconnected external drive is one possible backup medium, but a backup does not prevent data theft.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Best Value
The FBI cautions that paying a ransom does not guarantee data recovery and says it does not support paying. Its ransomware guidance covers prevention and reporting.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
