Ransomware groups no longer rely on encryption alone. Most now run a leak site: a public extortion page, usually on Tor, where they name victims, post deadlines and publish stolen data when a ransom goes unpaid. A listing turns a private incident into a public one, and it often reaches journalists, customers and other criminals before the victim has finished investigating.
ACID’s ransomware leak site monitoring watches these sites continuously and alerts you when your organization, a subsidiary or a key supplier appears. It is part of the dark web monitoring service and runs on ACID Intelligence.
What leak site monitoring covers
Leak sites change often. Groups rebrand, go offline after law-enforcement action, and reappear under new names. ACID tracks this churn so coverage follows the groups rather than a fixed list of addresses.
Monitoring covers:
- Ransomware and extortion group leak sites, including new and rebranded operations.
- Data-only extortion sites run by groups that steal data without deploying ransomware.
- Mirrors and file hosts where leaked archives are published.
- Forums and messaging channels where groups announce victims or leaks are reshared.
Keywords cover your legal names, brands, domains, subsidiaries and acquired companies, as well as the suppliers you choose to include.
Why it matters
A leak site listing is rarely the first sign of an attack, but it is often the first sign that the attack is about to become public. Monitoring helps in several situations:
- You are listed. You get the listing, deadline and claimed data in real time, which helps incident response, legal and communications teams prepare.
- A subsidiary or acquisition is listed. Group companies that run their own IT may not report an incident to headquarters quickly.
- A supplier is listed. Payroll providers, law firms, MSPs and software vendors hold sensitive data for many clients. A supplier listing can be your first warning that your data was exposed.
- You are named wrongly. Groups sometimes list the wrong company, recycle old data or exaggerate. Early notice lets you verify the claim before it spreads.
Breaches cost an average of $4.99 million in 2026 and took 183 days to identify (IBM). Knowing about a leak early shortens that window.
How it works
- Monitor. Crawlers revisit known leak sites and track new ones 24/7/365.
- Detect. New listings are matched against your keywords, including fuzzy matching on company names and domains.
- Alert. A real-time alert shows the group, listing date, deadline, claimed data and any samples, delivered to your dashboard, email, SIEM/SOAR or API.
- Mitigate. Your team verifies the claim, scopes the exposure and coordinates response, with updates from ACID as the listing changes.
Example alerts
- Critical: organization listed. A ransomware group adds the client to its leak site with a seven-day countdown and claims 400 GB of finance and HR data. Screenshots of internal documents are posted as proof.
- High: supplier listed. A payroll provider used by the client appears on a data-extortion site. The listing names several of the provider’s customers.
- Medium: data republished. An archive previously leaked from a subsidiary is reshared on a forum with a new download link.
Beyond the leak site
Leak sites are the last stage of an extortion campaign. Earlier signals include initial access offered by brokers, stolen credentials for remote access and chatter about a target. ACID watches for those too, through credential leak monitoring and Telegram and messaging monitoring, so teams can act before a listing ever appears.
For wider context, see our 2026 threat landscape roundup.
Get started
Request a free dark web scan to check for existing exposure, or talk to an analyst about monitoring leak sites for your organization and suppliers.
“The earlier you see planning-stage activity, the more options you have—foil the attack, close the gap, or contain the blast radius before public disclosure.”