What is a ransomware leak site?

A leak site is a website run by a ransomware group, usually reachable only through the Tor network, where it lists the companies it claims to have attacked and publishes their stolen data if they do not pay. A listing often starts with the company's name, a countdown and a sample of files, as pressure during negotiations. Leak sites are also marketing: they advertise the group's reach to potential affiliates. A few points for a company that finds itself listed. A listing is a claim, not proof; groups sometimes exaggerate or repost old data, so verify what was actually taken. It is also a strong indication that data left the network, which matters for GDPRGDPR: General Data Protection Regulation. The EU data protection law (Regulation (EU) 2016/679). notification. Law enforcement takedowns often replace leak sites with a seizure banner, as happened with LockBit in February 2024 and BlackSuit in July 2025. Monitoring services and national CERTs track these sites; do not visit them from company devices.

← All 25 questions on Ransomware groups and familiesAll topics