A ransomware leak page is a public website or onion site used by threat actors to list claimed victims, publish stolen files, or threaten disclosure. Its main purpose is pressure: attackers try to force payment by exposing an organization’s name, industry, and sometimes sample data.
For defenders, leak pages matter because they are an early signal of possible compromise, even when the underlying intrusion is not yet confirmed. A listing may indicate data theft, lateral movement, or extortion activity, but it can also be exaggerated or inaccurate. Security teams use these pages to support incident triage, verify whether any sensitive data matches internal systems, and assess whether backups, identity controls, and containment steps are needed.