What This Alert Means.
A ransomware leak site is a website where a criminal group names the companies it has attacked. The group often claims it stole data and threatens to publish it. This is called double extortion: the victim is pressured both by locked systems and by the threat of a data leak. A group may list a victim before or after it encrypts anything.
The alert means a listing matched your company name, a subsidiary or a partner. The claim may be true, exaggerated or about another company with a similar name. You will not know until you check. Act as if it is real while you verify it.
First 24 Hours.
The listing is public, so staff, customers and journalists may see it soon. Keep one person in charge and agree who speaks outside the company.
- SOC analyst Open the alert from the Brandefense Ransomware Intelligence module and save the listing text, date, group name and any sample files shownCapture it before it changes or disappears
- Incident lead Open your incident response plan and name one leadOne lead keeps decisions in one place
- IT admin Check whether anything is encrypted, and look for signs that data left your networkDo not wipe or rebuild any system yet
- Forensics lead Take a system image and a memory capture of a sample of affected devices, and collect the logsThis is the evidence handling step the CISA guide asks for
- Legal Call your legal counsel and your cyber insurer before any contact with the groupCheck what the policy and the law require of you
- Communications Prepare a holding statement and a short internal noteSay only what you have confirmed
- Incident lead Plan to report to law enforcement and your national CERTDetails are in the containment section
Investigation Checklist.
Use this list to decide whether the claim is true and how far it reaches. Write down who checked what and when.
- Is the named company, domain or subsidiary really yours?Rule out a similar name before you escalate
- Does the group show sample files or file names?Match them to your systems and teams
- Do any samples contain personal data, customer data or secrets?This drives who must be told
- Is any system encrypted or unavailable?The listing may come before or after encryption
- Do logs show data leaving your network or new accounts and tools?Look for large transfers and unknown admin tools
- Can you find the first entry point?Check VPN, remote access, phishing and supplier access
- Does the listing name the same group that earlier targeted a partner of yours?Check related alerts
- Are backups intact and offline?Test a restore from a copy the attacker could not reach
- Has the group posted a countdown or a contact channel?Record it, but do not use the channel yet
Containment And Removal.
You cannot delete a listing from a criminal group's site. Your work is to contain the attack, protect evidence and report it. The CISA ransomware guide lists these steps: isolate affected systems, preserve evidence, report the incident, and restore data from offline backups.
- Isolate: take affected systems off the network, but keep them powered on if you still need memory evidence.
- Law enforcement: CISA says victims of ransomware should report to federal law enforcement through the FBI Internet Crime Complaint Center (IC3) or a Secret Service field office. Outside the United States, use your national police cyber unit.
- National CERT: in Turkiye, report through USOM (usom.gov.tr). In other countries, contact the national CERT or cyber agency.
- Information to give: the FBI asks for the ransomware name, the file extension of encrypted files, any wallet address, the attacker's email, any website the attacker gave, the ransom amount, and whether you paid.
- Hosting or platform abuse: if the group uses a clearnet host or mirror, the hosting provider's abuse contact can be told. Sites on the dark web have no abuse contact, so do not expect removal.
- Counsel and insurer: your counsel decides on notices to regulators, customers and partners. Check your insurance policy for any notice terms.
Longer-Term Hardening.
Use the incident to close the gaps that let the group in.
- Keep offline, tested backups and practise a restore.
- Fix the entry point and reset credentials that the attacker could have seen, after you have scoped the intrusion.
- Require multi-factor authentication on remote access and admin accounts.
- Keep an up-to-date asset list so you know what a leaked sample came from.
- Rehearse the response with legal, communications and management, using this alert as the scenario.
- Write a lessons-learned note after recovery, as the CISA guide advises.
How To Measure That It Worked.
Judge the response by what you can show, not by whether the listing is gone.
- You can state which data was taken, from which systems, and who is affected.
- All required reports were filed and the dates are logged.
- The entry point is closed and confirmed by a retest.
- Systems were restored from clean backups, with no sign of the attacker returning.
- You keep watching leak sites and dark web sources for your name and data.
Common Mistakes.
- Contacting the group first. Speak to counsel, your insurer and law enforcement before anyone replies.
- Wiping systems too soon. You lose the evidence that shows how they got in and what they took.
- Believing the group's numbers. Claims about data size may be exaggerated. Check your own logs.
- Ignoring a listing that names a similar company. Still check, then record the decision.
- Telling no one inside. Staff who learn from the news will guess and share. Give them a short, true note.
- Treating the listing as the whole incident. The attacker may still have access.
Questions.
-
What should I do first if my company is on a ransomware leak site?
Save a copy of the listing, then confirm it is really your company. Open your incident plan, name one lead, preserve evidence from affected systems and call your legal counsel and cyber insurer. Do not contact the group before you have spoken to them.
-
Should we pay the ransom if our data is listed?
The FBI states that it does not support paying a ransom, and the NCSC says it does not encourage payment, because payment does not guarantee data recovery. Whether to pay is a decision for your leadership with legal counsel and law enforcement. Do not decide it alone or in a hurry.
-
Who do we report a ransomware incident to?
In the United States, CISA says to report to federal law enforcement through the FBI IC3 or a Secret Service field office. In Turkiye, report through USOM. Elsewhere, use your national police cyber unit and national CERT. Your counsel will advise on regulator and customer notices.
-
Can we get our company removed from the leak site?
Usually not. These sites run on the dark web with no abuse contact and the group controls them. Focus on containing the attack, protecting evidence, reporting and informing the people affected. Removal by the group should not be part of your plan.
-
What evidence should we keep after a ransomware listing?
The CISA guide advises taking a system image and a memory capture of a sample of affected devices, plus relevant logs and samples of any early malware. Also save the listing, screenshots, ransom notes and any contact details the attacker gave.
Sources
This page is general security guidance. It is not legal advice. Notification duties and takedown rights depend on your country, your contracts and the facts of the case, so ask your legal counsel before you act on them.