# What is a ransomware leak site?

A leak site is a website run by a ransomware group, usually reachable only through the Tor network, where it lists the companies it claims to have attacked and publishes their stolen data if they do not pay. A listing often starts with the company's name, a countdown and a sample of files, as pressure during negotiations. Leak sites are also marketing: they advertise the group's reach to potential affiliates. A few points for a company that finds itself listed. A listing is a claim, not proof; groups sometimes exaggerate or repost old data, so verify what was actually taken. It is also a strong indication that data left the network, which matters for GDPR notification. Law enforcement takedowns often replace leak sites with a seizure banner, as happened with LockBit in February 2024 and BlackSuit in July 2025. Monitoring services and national CERTs track these sites; do not visit them from company devices.

FAQ: [Ransomware groups and families](https://netsenx.com/en/faq/ransomware-families) · https://netsenx.com/en/faq/what-is-a-ransomware-leak-site

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/blog/2026-10-24_ransomware-protection

## Related questions

- [Where can we find official information about ransomware groups?](https://netsenx.com/en/faq/where-to-find-official-ransomware-advisories)
- [What is No More Ransom, and can it decrypt our files?](https://netsenx.com/en/faq/what-is-no-more-ransom)
- [What does a police takedown of a ransomware group mean for victims?](https://netsenx.com/en/faq/what-does-a-ransomware-takedown-mean-for-victims)
- [Why do ransomware groups change their names?](https://netsenx.com/en/faq/why-do-ransomware-groups-rebrand)
- [How should a small company use a ransomware advisory?](https://netsenx.com/en/faq/how-a-small-company-should-use-a-ransomware-advisory)