Clop ransomware group claims data breach against IRCO.COM

• Ransomware group: Clop
• Country: Iran
• Announcement date: August 12, 2026

Clop ransomware group claims data breach against IRCO.COM

The Clop ransomware group has published an announcement on its leak site claiming to have exfiltrated data belonging to IRCO.COM. This latest claim follows a pattern of behavior observed with this threat actor, as they have listed the organization on their platform, alleging that they have successfully obtained sensitive information from the entity.

Details of the alleged incident

According to the announcement made by the Clop group, the incident is reported to have occurred on August 5, 2026. The group alleges that they have exfiltrated sensitive data from the organization, specifically claiming that various technical documents and commercial files were obtained during the operation. The announcement, which was posted on August 12, 2026, suggests that these files may be leaked or sold to other parties.

While the group has made these claims, it is important to note that no screenshot has been provided to verify the contents of the alleged breach. Furthermore, no information was provided regarding the specific ransom demand or the total size of the data taken. The group's announcement is categorized as a data leak notification.

Alleged exfiltrated data types

The group claims to have obtained a wide range of technical and commercial documentation. The alleged exfiltrated data includes the following items:

• CAD files
• PDF drawings
• Diagrams
• Product presentations
• Specifications
• Manuals
• Instructions

The inclusion of such detailed technical documentation suggests a significant focus on the organization's intellectual property and operational details.

About IRCO

IRCO (Ingersoll Rand) is a global company specializing in the design and manufacturing of industrial equipment. Their product portfolio includes a variety of essential industrial components, such as air compressors, vacuum pumps, blowers, and fluid management systems.

Analysis and potential impact

The Clop group is known for exploiting vulnerabilities in file transfer software to conduct large-scale data exfiltration campaigns. This specific incident may lead to the compromise of intellectual property and the exposure of trade secrets. Given that the leaked data reportedly includes technical documentation, it could create secondary risks for the organization's operational security. Furthermore, such leaks may result in reputational damage among clients and business partners.

Considering the group's past methods, it is possible that the data could be offered for sale on the dark web or further exposed. In such scenarios, organizations often face the challenge of double extortion, where attackers not only encrypt systems but also threaten to release sensitive information to pressure the victim into paying a ransom.

To mitigate these types of risks, organizations in the industrial sector can implement various defensive measures. These include hardening external-facing file transfer software, implementing strict access controls, and maintaining robust monitoring of data movement to detect unauthorized exfiltration. Protecting intellectual property requires a multi-layered security approach that focuses on both preventing initial access and limiting the ability of an attacker to move laterally or extract large volumes of data.