Guide

You've had a ransom or extortion demand. Don't pay yet — do this first.

by Ken Armitt, Founder · updated 31 July 2026

Establish whether the claim is real before reacting — many extortion emails are bulk bluffs. Preserve the message and full headers, look for genuine signs of access or data exfiltration, and don't pay or reply on impulse: payment rarely ends it and can mark you as a willing target. If customer personal data was genuinely exposed, a legal notification clock (NDB in Australia, GDPR in the EU) may already be running.

Is the threat actually real?

A large share of these are volume extortion: identical emails blasted to thousands of domains claiming access they don't have, hoping a few pay. Signs it might be real include a sample of genuine data, evidence of access in your logs at the time claimed, or a specific technical detail only an intruder would know. Vague threats with no proof usually have none.

Why paying is rarely the end

There's no enforceable "delete" you can buy, payment confirms you'll pay, and it does nothing about the access that made the threat possible. The durable fix is the same as any hack: find how they got in, close it, and remove what they left — so there's nothing to extort next month.

If it's genuine: the clock and the notification

If personal information about your customers was exposed, you may have legal obligations with deadlines — Australia's Notifiable Data Breaches scheme and the EU's GDPR both put a clock on assessment and notification. Preserve everything, scope what was actually exposed, and get advice early. This is guidance, not legal advice — but the worst move is to assume it isn't real and let the clock run out.