A victim ledger is a public list used by extortion groups to name organizations they claim to have compromised or targeted. It may appear on a leak site, a ransom page, or another public channel used to pressure the victim. A ledger does not automatically prove a full breach, but it does create reputational pressure and can signal that attackers are escalating demands.
For defenders, the value of a victim ledger is as an early warning and a source of intelligence. Security teams can compare the claim against logs, account activity, endpoint alerts, and backup status to determine whether access was real, partial, or fabricated. They should also watch for leaked filenames, sample data, or credentials that may confirm impact. In practice, these ledgers are part of modern ransomware and extortion operations: they help attackers advertise success, intimidate targets, and attract new victims, while giving analysts a starting point for validation and response.