A ransomware naming site is a public leak page, victim list, or extortion portal used by threat actors to name organizations they claim to have compromised. These sites may display company names, sample files, countdown timers, or negotiation prompts. The goal is pressure: by making an allegation public, attackers try to force payment, embarrass the target, and attract attention from customers, partners, and the media.
For defenders, a naming site is useful intelligence but not proof of the full incident. A listed victim may indicate intrusion, data theft, or only an unverified claim. Security teams should treat the post as a signal to investigate logs, privileged access, endpoint alerts, and signs of data exfiltration, while avoiding premature conclusions. In practice, these pages appear in double-extortion campaigns, where the attacker threatens to publish stolen data if the victim does not comply. The site is part of the extortion infrastructure, not evidence of scope by itself.