A certified ethical hacker (CEH) completed a penetration test of the main headquarters of a company almost two months ago, but has yet to get paid. The customer is suffering from financial problems, a

Threatening to publish confidential penetration test results as leverage for payment is extortion and violates both legal statutes and the CEH code of ethics regarding client confidentiality.

The EC-Council Code of Ethics and general professional conduct standards require that disputes over payment be resolved through lawful means such as civil litigation, mediation, or collection agencies. This approach respects the confidentiality obligations the CEH accepted when performing the test and does not expose the CEH to criminal liability. Any other option involving the use of test findings or system access as coercion would constitute extortion or unauthorized access under laws such as the CFAA.

Disclosing a client's financial difficulties to other customers violates confidentiality obligations and could constitute defamation or tortious interference depending on jurisdiction.

Exploiting vulnerabilities discovered during an authorized engagement to deface a website constitutes unauthorized computer access and is a criminal act under laws such as the Computer Fraud and Abuse Act, regardless of payment disputes.