A data leak site (DLS) is a website run by a ransomware or extortion group to name its victims and publish their stolen data. Most leak sites run as Tor onion services. They are also called shame sites, because their main purpose is public pressure.

How it works

• Attackers copy data out of the victim’s network before or instead of encrypting it.
• The victim is listed on the site, often with a countdown and a sample of the files as proof.
• If no payment is made, the group publishes the data or offers it for sale.
• In ransomware-as-a-service programs, access to the leak site is one of the services the operator provides to affiliates.

The UK NCSC notes that leak sites are designed to raise pressure on victims who also face regulatory fines for a breach. MITRE ATT&CK notes that adversaries may use dedicated leak sites to distribute victim data.

Why it matters for dark web monitoring

A leak site post may be the first sign that a supplier or partner has been breached. It can also expose data about a company’s staff or customers that was held by a third party. Watching leak sites helps teams confirm an incident, judge what was taken and start incident response and notification steps early. Monitoring for leaked data and breaches covers these sites alongside other sources.

Sources: NCSC: Ransomware, extortion and the cyber crime ecosystem, MITRE ATT&CK T1657: Financial Theft