Callhci.com listed on Inc Ransom leak site

• Ransomware group: Inc Ransom
• Country: United States
• Sector: Technology
• Announcement date: October 1, 2025

Inc Ransom claims data breach at callhci.com

The Inc Ransom ransomware group has listed the United States-based telecommunications provider callhci.com on its leak site. According to the announcement made by the threat actors, the organization has been targeted in a cyberattack resulting in a significant data leak.

The group claims to have gained unauthorized access to the organization's network on August 29, 2025. Following this alleged intrusion, the group announced on October 1, 2025, that they had successfully exfiltrated data belonging to the company. This timeline suggests a period of several weeks between the initial claimed access and the public announcement on the leak site.

Details of the alleged data exfiltration

While the group has made a public announcement regarding the breach, specific details concerning the exact content of the leaked data have not been provided. However, the group has shared information regarding the scale of the incident. The announcement alleges that approximately 89.49 GB of data has been exfiltrated from the organization's systems.

The listing does not specify the exact file count or the nature of the files involved. While no specific details regarding the content of the leaked data have been provided, a screenshot associated with the announcement implies the presence of data related to the organization's business operations. The listing names no specific data types within the announcement.

The organization profile

Callhci.com, known as Heritage Communications, is a B2B telecommunications provider. The company offers NEC-based cloud and on-premise VoIP services to businesses located in Arkansas and West Tennessee. With over 30 years of experience, the organization focuses on providing scalable and customizable communication solutions to its client base.

Analysis and potential implications

Considering the double-extortion tactics frequently employed by the Inc Ransom group, there is a risk that the leaked data may be made public or offered for sale if a ransom is not paid. In such scenarios, threat actors use the threat of releasing sensitive information to pressure organizations into meeting their demands.

Given that the organization operates in the telecommunications sector, there may be a risk of exposure for customer communication data and trade secrets. For a B2B provider, the exposure of operational data can have cascading effects. Furthermore, as a US-based entity, potential data breaches may be subject to state-level privacy laws and federal regulations.

Such a leak could lead to secondary risks for the organization's clients, including identity theft or targeted phishing attacks. Organizations in the telecommunications sector often face these risks due to the sensitive nature of the communication services they provide. General defensive steps for organizations facing such threats include implementing robust network monitoring, enforcing multi-factor authentication, and maintaining comprehensive data encryption protocols to mitigate the impact of unauthorized access.

Public information regarding the Inc Ransom group remains limited, making it difficult to determine their specific long-term objectives or technical methodologies beyond these claims.