Ransomware PR: When a Threat Actor Goes Public Before You Do

The traditional breach disclosure sequence runs like this: detect the incident, investigate, engage counsel, notify regulators, then make a public statement. Your timeline, your words, your frame.

Ransomware groups broke that model years ago. Today, the incident is increasingly public before you've said a single word. The threat actor posts your company name on their leak site, attaches a sample of your data as proof, sets a countdown clock, and sometimes notifies journalists directly. By the time your communications team wakes up, reporters at The Record or BleepingComputer are already asking for comment.

Over 7,500 unique victim organizations were listed on public leak sites in 2025, up from roughly 4,750 in 2024.