Loading story…
The INC Ransom ransomware group claimed responsibility for a cyberattack on the Pennsylvania Office of the Attorney General, alleging the theft of 5.7 TB of data. Data samples purportedly stolen from the office were posted on INC's leak site, though the state has not confirmed the extent of the breach and has refused to pay the ransom. This incident is notable as the largest reported data theft from a U.S. government entity in 2025, according to security researchers. The attack highlights the growing threat posed by the INC Ransom group, which has targeted multiple high-profile organizations in recent months.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
In response to the incident, Pennsylvania's Office of the Attorney General said it would not pay ransom demands. The agency had not acknowledged the group's exfiltration claim at the time of reporting.
After the alleged intrusion, INC Ransom published multiple samples of purportedly stolen Pennsylvania OAG data on its leak site to support its extortion claim. The posting publicized the alleged scale of the theft.
INC Ransom claimed it compromised Pennsylvania's Office of the Attorney General in a cyberattack that occurred the month before the September 2025 reporting. The group alleged it stole 5.7 TB of data from the agency.
Within the 12 months preceding September 2025, INC Ransom publicly claimed several notable victims, including Ahold Delhaize USA, Dollar Tree, and two UK National Health Service hospitals. These claims reflected the group's continued activity and expanding victim list.
INC Ransom began operating more than two years before September 2025 and grew into a prolific ransomware-as-a-service group. Over the following years, it was linked to numerous victim claims across multiple sectors.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Pennsylvania Office of the Attorney General suffered a ransomware attack in August 2025, resulting in the theft of files containing personal and medical information, including Social Security numbers. The attack, claimed by the INC Ransom gang, disrupted the office’s operations by taking down its website, email, and phone systems, and forced staff to use alternative communication methods for nearly a month. The breach was discovered on August 9, and subsequent investigation confirmed that sensitive data was accessed and stolen, though officials have stated there is no evidence of misuse so far. The ransomware group claimed to have stolen 5.7TB of data, and the office has notified affected individuals and the FBI. Security experts noted that the office had vulnerable Citrix NetScaler appliances exposed to the internet, which may have facilitated the breach. The incident caused significant disruption to Pennsylvania’s legal system, including delays in criminal and civil cases, but the office refused to pay the ransom demanded by the attackers.
Jun 29, 2026
Researchers published new intelligence on **INC Ransom**, outlining a victim negotiation platform allegedly exposed at `178.20.41.208:1002` and describing a stack built on **nginx**, **Yii/PHP**, and a **React/Redux/Socket.io** frontend. The reporting says the group’s infrastructure spans clear-web and onion sites with repeated overlap in Russian hosting, and that INC has operated since 2023, listed more than **870 victims**, and may share code or branding lineage with **Lynx** and possibly **Sinobi**. Separate technical reporting described INC as a **multi-extortion** operation that primarily targets healthcare, industrial, and education organizations in the U.S. and Europe, using living-off-the-land tools such as **NETSCAN.EXE**, **AnyDesk**, and `SystemSettingsAdminFlows.exe`, along with Defender tampering and a custom `av.exe` utility to disable EDR protections. At the same time, multiple new victim claims attributed to **incransom** surfaced, affecting organizations in nonprofit services, manufacturing, healthcare support, and other sectors across the **United States, Mexico, and Switzerland**. Reported victims included **Foundations to Freedom** in Florida, **DUCON** in Colorado, **minigrip.com.mx** in Mexico, **Della Casa Group AG** in Switzerland, and a Minnesota-based residential care provider associated with **eclmn.com**. The victim summaries describe unauthorized access to confidential files including client data, financial records, R&D material, and project information; in the Swiss case, the leak allegedly involved **86,332 files** in **15,359 folders** totaling about **240 GB**, underscoring INC Ransom’s continued emphasis on data theft and public leak pressure alongside encryption.
Jul 29, 2026Panama's Ministry of Economy and Finance (MEF) disclosed a cyber incident involving a compromised workstation, which was quickly contained according to official statements. The INC Ransom group has claimed responsibility, alleging theft of over 1.5 TB of sensitive data, including emails and financial documents, and has published samples as proof. MEF asserts that core systems remain unaffected and has not confirmed the extent of the data breach claimed by the attackers.
Jun 29, 2026