Tyler Hudak, practice lead of incident response for cybersecurity consulting firm TrustedSec, said that a situation facing Citrix regarding an alleged hack is fairly common: attackers break into an organization, steal data and attempt to sell it on the dark net. Increasingly, ransomware attackers, before releasing the ransomware, will steal the data and threaten to publish it as extortion, Hudak said.