{"id":8933,"date":"2026-02-12T12:00:00","date_gmt":"2026-02-12T10:00:00","guid":{"rendered":"https:\/\/blog.eset.ee\/et\/?p=8933"},"modified":"2026-06-14T19:58:36","modified_gmt":"2026-06-14T16:58:36","slug":"naming-and-shaming-how-ransomware-groups-tighten-the-screws-on-victims","status":"publish","type":"post","link":"https:\/\/blog.eset.ee\/et\/en\/2026\/02\/12\/naming-and-shaming-how-ransomware-groups-tighten-the-screws-on-victims\/","title":{"rendered":"Naming and shaming: How ransomware groups tighten the screws on victims"},"content":{"rendered":"

In the realm of cybercrime, change is arguably the only constant. While cyber-extortion<\/a> as a broader category of crime has proved its staying power, ransomware \u2013 its arguably most damaging \u2018flavor\u2019 \u2013 doesn\u2019t live or die on encryption alone. The playbook of \u2018yore\u2019 largely involved locking files or systems and demanding payment for a decryption key, but in recent years campaigns switched to combining encryption with data exfiltration and threats to publish the stolen information.<\/p>\n

This is where dedicated leak sites, or data leak sites (DLSs), come in. First appearing in late 2019, DLSs have since become the backbone of the double extortion strategy. Threat actors steal corporate data (before encrypting it) and then weaponize the loot publicly, effectively turning a security incident into a full-blown public crisis.<\/p>\n

Security experts and law enforcement have, of course, been tracking this shift for years. The FBI and CISA now routinely describe ransomware as a \u201cdata theft and extortion\u201d problem. Public tracking projects such as Ransomware.live<\/a> point in the same direction, even if precise victim counts should be treated with caution. The leak sites reflect only what criminals choose to \u2018advertise\u2019, not the full universe of incidents.<\/p>\n

Let\u2019s examine the role of DLSs in the ransomware ecosystem and the implications for victim organizations.<\/p>\n

How do ransomware groups use data leak sites?<\/h2>\n

Hosted on the dark web and accessible through the Tor network, the sites often publish a sample of stolen data and threaten victims with full public disclosure unless payment is made. Sometimes the material is published after the victim refused to cave in, thus further turning the screw on them. Information about the victims, the extent of stolen material and even deadlines that are meant to feel inexorable are all part of the strategy.<\/p>\n

\"Figure
Figure 1. Number of publicly reported victims on data leak sites, collected via ecrime.ch (source: ESET Threat Report H2 2025<\/a>)<\/em><\/figcaption><\/figure>\n

What makes the strategy devastating is speed and amplification. Once the incident is in the open, multiple risks are collapsed into a single, highly visible moment and the victim organization operates under a cloud of suspicion and uncertainty \u2013 often even before its IT and security staff have a full picture of what was stolen or how far the intrusion spread. And that is, of course, the point \u2013 data leak sites are a coercion tool.<\/p>\n

This is also why they\u2019re carefully curated. Attackers often publish just enough material to show that they are not bluffing: a handful of contracts or a tranche of emails. More is coming unless the victim caves in.<\/p>\n

Indeed, the damage rarely stops with the initial victim. The data, once dumped or resold, becomes fuel for follow-on crime, and security teams see it reappear in phishing kits<\/a>, business email compromise<\/a> (BEC) campaigns, and identity fraud schemes<\/a>. In supply-chain incidents, one breach can ripple outward, exposing the victim\u2019s customers and partners. This cascading effect is partly why authorities treat ransomware as a systemic risk, rather than a series of isolated mishaps.<\/p>\n

\"Figure
Figure 2. Typical LockBit leak site (source: ESET Research<\/a>)<\/em><\/figcaption><\/figure>\n
\"Figure
Figure 3. Data leak site of the Medusa ransomware<\/em><\/figcaption><\/figure>\n

Pressure by design<\/h2>\n

Every element of a leak site is designed to maximize psychological pressure.<\/p>\n