Ransomware uses the dark web for 'leak sites' — onion services where gangs publish data stolen from victims who won't pay. This is double extortion: attackers steal a copy of the data before encrypting it, so backups no longer save you. Leak sites live on the dark web because an onion service hides their location and can't easily be seized. The real defence is upstream: backups, patching, and stopping the initial break-in.
- Double extortion: attackers first steal sensitive data, then encrypt systems, and then threaten to publish the stolen files unless a second ransom is paid; this turns a recovery problem into a disclosure crisis.
- Leak sites are Tor onion services where ransomware groups list victim names, describe what was taken, and run countdown timers to pressure payment before a scheduled data dump.
- Onion hosting routes traffic through multiple encrypted layers and does not expose the server’s IP address, so law enforcement cannot easily locate or shut down the site by seizing a physical host or domain registrar.
- Paying is fraught — there is no enforceable guarantee that decryptors will work, that stolen data will actually be deleted, or that the same group will not extort the victim again; copies may still be sold or published later.
- The real defence is upstream, before the leak site: enforcing multi-factor authentication, patching exposed services, segmenting networks, monitoring for initial access, and maintaining offline backups reduce the chance of becoming a listed victim.
Ransomware and the dark web are deeply linked, but not in the way most people assume. The dark web didn't create ransomware — it gave the threat a place to stand, in the form of “leak sites” that turn a private attack into a public extortion.
Double extortion
Ransomware used to be simple: your files are locked, pay to unlock them. Then organisations got better at backups and started refusing to pay. The criminals' answer was to add a second threat: before encrypting, they steal a copy of the data, then threaten to publish it. Now backups don't save you — your confidential data will be exposed regardless. This is double extortion.
The leak site
The threat is made real on a ransomware leak site: a public onion service, often styled like a corporate blog, listing victims with a countdown. Pay by the deadline, or the stolen data is published. Some gangs release a “proof” sample, then the full dump. The design is theatrical because the product is fear — making the next victim pay.
Why on the dark web
A leak site must stay reachable while being hunted worldwide. An onion service hides where it's hosted, so there's no server to seize by pulling a plug. The same anonymity that protects a whistleblower's dropbox protects the extortionist's billboard — the network can't tell the difference.
Should you pay?
There's no clean answer. Paying is often legal but fraught: no guarantee the data is deleted, it funds more attacks, and paying some sanctioned groups is unlawful. Law enforcement broadly discourages it, because a criminal's promise to delete stolen data is worth nothing.
Where the defence lives
Everything that matters happens before the leak site. Ransomware crews usually get in via bought access, an unpatched system, or a phished credential. The real defences are upstream: backups, prompt patching, phishing-resistant authentication, and detecting the intrusion early. The leak site is the last stage of a long chain.
Frequently asked questions
What is a ransomware leak site?
An onion-based 'name and shame' page where a ransomware gang publishes data stolen from victims who refuse to pay. It's the public face of double extortion — the threat to release your data unless you pay, on top of encrypting your files.
What is double extortion?
A ransomware tactic that adds a second threat to encryption: attackers steal a copy of your data before locking your files, then threaten to publish it. This defeats the 'we'll just restore from backup' defence, because backups can't un-publish data.
Why are ransomware leak sites on the dark web?
Because an onion service hides where it's hosted, so the site can't simply be seized by taking a server or domain — it must stay reachable while hunted worldwide. It's the same location-hiding property that protects a whistleblower's dropbox.
Should you pay a ransomware demand?
There's no clean answer. Paying is often legal but risky: no guarantee the data is deleted, it funds more attacks, and paying some sanctioned groups is unlawful. Law enforcement broadly discourages it.
How do you defend against ransomware?
Upstream, before the leak site. Crews usually enter via phished credentials, unpatched systems, or bought access. The defences are backups, prompt patching, phishing-resistant authentication, segmentation, and detecting intrusions early.