An extortion leak site lists your company with a 2.1 TB claim and a 72-hour timer — what does that prove?

## The listing is marketing, and it is written by the other side A leak-site entry exists to create pressure. Every number on it was chosen by the party that stole the data, and none of it was produced under any obligation to be accurate. So the first discipline is to separate what it *proves* from what it *claims*. **What it proves.** That an actor has published a claim naming you — which is itself a material fact, because it makes exfiltration a public assertion rather than an internal hypothesis. If a proof sample is attached, it proves possession of the files inside that sample: those specific paths, those specific contents, at some time before the post. **What it does not prove.** That 2.1 TB left your estate. Volume claims are routinely inflated, are sometimes the size of a directory listing rather than of copied content, and are occasionally simply wrong. It does not prove the listed categories were taken; it does not prove the poster is the same operator who encrypted your datastores, since access is bought and sold; it does not prove they still hold the data; and it does not prove they will publish on the timer. **What its absence would not prove.** A company that is not listed has not been shown to be safe. Listings appear late, selectively, and only for victims the actor chooses to pressure. ## What the timer actually is The countdown is a commercial instrument. Actors extend it, shorten it, restart it after contact, and stage publication in parts to keep pressure on. Treating it as a technical deadline hands the pace of your response to the adversary. Two consequences for the playbook: nominate an owner who watches the listing and reports changes, and make explicit that the timer does not drive your notification decisions. Obligations to customers, partners and regulators turn on what you can establish about what data was affected, not on when a criminal says they will publish. ## Turning it into an investigative anchor The sample is the most useful part of the listing, precisely because it is the only part with content. File names and paths are concrete: they tell you which share, which project directory, which finance folder. That converts an unbounded question — what did they take — into a testable one. Go to the surfaces that would record the movement of exactly those files: file-server access auditing, endpoint telemetry on hosts with that share mounted, proxy and DNS records for the period, flow records to any external destination, and the cloud or SaaS audit trails if the data also lived there. Note the limit of each: a flow record shows that bytes moved between two endpoints and carries no payload at all, so it can corroborate volume and destination and never content. The sample gives you the latest possible date for the theft; your own telemetry gives you the earliest one you can defend. ## Handling it without damaging your own position Practical points that separate a rehearsed team from an improvising one: - **Preserve first.** Capture the page with a timestamp, record the hash of anything you retrieve, and note who captured it. Listings change and disappear; if you later have to describe what was claimed and when, your record is the only one you control. - **Do not browse from the corporate estate.** Retrieval belongs to your retained responders or an intelligence function using appropriate infrastructure, not to an analyst on a company laptop. - **Route acquisition through counsel.** A sample may contain your own regulated data, other organisations' data, or third-party personal data. The decision to download and where to store it is a legal one, not an operational preference. - **Do not rush a takedown before you have recorded it.** Removing the page destroys the record of the claim and rarely removes the data. ## What you tell the executive The answer they need is calibrated, not reassuring: the actor has published a claim and demonstrated possession of a sample; the total they assert is unverified; here is what our own logs so far support; here is the date range we can and cannot cover; the deadline is theirs to move and we are not planning against it. That is a defensible statement. "They say 2.1 TB, so 2.1 TB is gone" is not, and neither is dismissing the listing as bluff — the sample on the page is the one part of it that is real.