Intelligence
What is Leak site?
A site run by an extortion operator where victims who refused to pay are named and their stolen files published.
A leak site is a website, usually on Tor, run by an extortion group to name victims and publish their stolen data. Ransomware groups use them to put pressure on organisations that refuse to pay.
For intelligence teams, leak sites are a collection source. Victim listings show who a group is targeting, which sectors and countries, and how active the group is. They are also unreliable: groups exaggerate, relist old victims and sometimes post claims they cannot back up.