This guide shows how to investigate a leak-site ransomware claim, preserve evidence, and decide who to notify. Leak-site ransomware is double-extortion ransomware, where attackers steal sensitive data before encryption and threaten to publish it.
CISA describes this theft-before-encryption model in its CISA #StopRansomware advisories, noting harm persists after systems are restored. Use the guide when you see your name on a leak site, receive an extortion note, or suspect data theft. It helps security, legal, and leadership verify the claim before notifying customers or regulators.
Table of Contents
- What evidence should you save first?
- Is the leak-site listing real?
- Should you pay, contact the attackers, or report?
- Who must you notify and when?
What evidence should you save first?
Isolate affected systems quickly, but keep them powered on when disconnection is possible. CISA and the FBI direct victims to preserve volatile proof such as memory, logs, and ransom notes. Memory and logs can show access, theft, and encryption timing.
Save the original ransom note, leak-site URL, screenshots, and posted samples. Record discovery time, affected systems, and who touched each device. Keep one copy offline so cleanup does not overwrite proof.
- Disconnect systems from the network while leaving power on
- Capture memory, endpoint telemetry, firewall and access logs
- Preserve ransom notes, chat messages, and leak-site samples
- Log dates, custodians, and storage locations for every item
Is the leak-site listing real?
A listing alone does not prove compromise or publication. The FBI warns attacker claims are often recycled, exaggerated, or fabricated. Corroborate with intrusion logs, endpoint telemetry, and samples of posted data before notifying.
Compare posted samples against real records, file names, timestamps, and account data. Check whether logs show access to those same systems and accounts. A mailed extortion letter can also be a scam. The FBI assessed letters claiming to be BianLian and demanding $250,000–$500,000 in Bitcoin within 10 days as scams with no link to real intrusions.
Should you pay, contact the attackers, or report?
The FBI states it does not support paying ransoms because payment does not guarantee data return or deletion. Payment also leaves stolen copies in criminal hands and invites repeat demands. Treat any promise to delete stolen data as unenforceable, described in FBI ransomware guidance.
Report promptly to a local FBI field office or IC3 regardless of the payment decision. Share ransom notes, wallet addresses, leak-site links, logs, and timelines. Early reporting can support seizure, decryption, victim notification, and cross-victim tracking.
Who must you notify and when?
For public companies, the SEC requires Form 8-K Item 1.05 within four business days after determining an incident is material. The filing must describe nature, scope, timing, and material impact, as detailed in the SEC Final Rule 33-11216. Start the materiality review early so security findings reach counsel and leadership fast.
For health data, HHS OCR requires notice of unsecured PHI breaches to affected individuals and HHS without unreasonable delay and within 60 calendar days of discovery. Large breaches also need prominent-media notice, according to HHS breach-notification guidance. Notify only after verifying whose data was actually exposed.
You Might Also Like
- CDK Global Ransomware Investigation Guide: Evidence, Notices, and Verification
- Cybersecurity — TransUnion Breach Investigation Guide: Evidence, Notices, and Verification
- Ransomware Attacks Explained for 2026: Who It Affects, Key Evidence, and What to Do Next