When a ransomware group claims a data breach: what to do

In short: When a ransomware gang posts your bank, employer, or favorite service on its leak site, that's an unverified extortion claim, not a confirmed breach. CISA and the UK NCSC both note that gangs use data-theft threats as pressure tactics, and companies often confirm a much smaller incident than the one claimed — as PwC did after the Everest group's claim. Wait for an official notice from the named company before you act.

Seeing a company you trust show up on a ransomware tracker is unsettling. The entry usually just means a criminal group posted a claim, with a countdown clock and a promise to leak files if they aren't paid. That claim is a threat the gang is making to pressure the company, not an independently checked fact. Here's how to read it, and what to do while the real story unfolds.

What does it mean when a hacker group "claims" a data breach?

It means a criminal group has posted the company's name on its own leak site, usually with a description of what it says it stole and a deadline to pay. CISA describes ransomware as malware that locks up a victim's files, and notes that "ransomware actors often target and threaten to sell or leak exfiltrated data or authentication information if the ransom is not paid," which is exactly what a leak-site post is doing: advertising the threat (CISA, StopRansomware). The post is written by the attacker, about themselves, with no outside check on whether it's true, how much data they really have, or whether it's current.

Why do ransomware gangs name victims on leak sites?

Naming names is leverage. The NCSC explains that victims "increasingly face an extortion threat, where the attacking cyber criminal group threatens to publish or sell stolen data unless a ransom is paid" (NCSC). Europol's threat assessment, reported by Industrial Cyber, found the criminal business model is shifting even further toward this tactic: "The extortion model is shifting away from data encryption toward pure data theft, with attackers increasingly relying on the threat of exposure to force payment" (Europol IOCTA 2026, via Industrial Cyber). Europol also found companies are better prepared for losing data than for the fallout of it being published, and gangs combine leak threats with DDoS attacks and direct calls to staff to maximize the pressure. Some ransomware platforms now sell leak-site hosting as a built-in service to other criminals, making a public "name and shame" post cheap and easy to produce.

How often are ransomware claims real, exaggerated, or recycled?

There's no reliable public count, but the structure of the business gives gangs every reason to overstate. The NCSC tells victim organizations not to accept a gang's numbers at face value: "You may want to verify, to the best of your ability, that any claims about the nature and amount of data stolen are true" (NCSC). Even after a ransom is paid, the NCSC warns the attacker may lie about deleting the data and resell or re-threaten it "months, or even years, after the incident." A claim is marketing for an extortion attempt, written by the extortionist.

What's the difference between a claimed breach and a confirmed breach?

A claim is a gang's own post. A confirmed breach is the company's own statement, or a notice from a regulator, describing what actually took place. The two can look very different. Everest, a ransomware group, posted PwC on its leak site in October claiming to have stolen 590 GB of HR and training data (Beinsure). PwC's confirmed account was narrower: it said the affected system was a third-party vendor's employee learning platform, and that "the affected site does not house client data, sensitive personal data or financial information." PwC also declined to confirm the volume Everest claimed, leaving the gang's figure unverified. Treat a leak-site post as the opening move, and the company's own statement, or a regulator notice, as the fact pattern.

What should I do if my bank, employer, or a service I use is named in a ransomware claim?

Follow this checklist while you wait for the company to say more:

1. Don't panic. A leak-site post is an unverified claim, and reacting right away — paying anyone for "protection" or handing over more personal information — tends to cause more harm than waiting a day for facts.
2. Wait for the company's own notice or breach letter rather than reacting to the leak-site post itself.
3. Watch your email and texts for phishing that references the alleged breach; see our phishing after a breach guide for what scam messages look like.
4. Turn on two-factor authentication on your account with the named company and on any account that reuses the same password.
5. If your Social Security number may be involved once a breach is confirmed, consider a credit freeze.
6. Monitor your bank and account statements for unfamiliar activity.
7. Follow our step-by-step checklist once the company confirms a breach, since the right response depends on what data was actually taken.

Is it safe to visit a ransomware leak site or contact the attackers?

No. Leak sites are run by the criminals who stole, or claim to have stolen, the data, and visiting them or engaging with anyone offering to sell "your data back" puts you in direct contact with extortionists, with no guarantee they have your data or will do anything but take your money. The NCSC warns that even organizations that pay a ransom have no assurance the attacker deletes the stolen files, and notes the UK's data protection regulator does not treat a ransom payment as something that lowers regulatory risk or any resulting penalty (NCSC). There's no customer-side version of paying your way out of a claim — the only useful moves are the ones on the checklist above.