A victim label is an attribution that identifies a company or organization as the target of a cyberattack, extortion attempt, or breach claim. It may appear on a leak site, in ransomware notes, on dark web forums, or in threat reports, and it can be based on verified compromise or on an unproven accusation.
In cyber security, victim labels matter because public naming can create immediate pressure on the target before investigators confirm facts. Attackers use labels to amplify fear, build credibility, or coerce payment. Defenders treat them as leads, not proof: they verify logs, endpoint alerts, access records, and data movement before concluding whether a real intrusion, exfiltration, or encryption event occurred.