Coop57 listed on incransom leak site

• Ransomware group: incransom
• Country: Spain
• Sector: Financial Services
• Announcement date: April 8, 2025

Incransom claims data breach at Coop57

The threat actor known as incransom has listed data it claims belongs to the organization Coop57 on its leak site. According to an announcement made on April 8, 2025, the group alleges that data was obtained from the organization's systems. The post accompanying the claim includes screenshots related to the organization's operations and the files allegedly exfiltrated during the incident.

Ransomware leak sites serve as a platform for cybercriminals to exert pressure on victims through public exposure. These sites are used to host stolen data, often accompanied by countdown timers or specific demands to coerce the victim into paying a ransom. When a group uses a leak site, they are typically employing a tactic known as double extortion. In this scenario, the attackers do not just encrypt the victim's systems to disrupt operations; they also steal sensitive information to threaten the public release of that data, thereby increasing the likelihood of a payout.

Details of the alleged data exfiltration

The announcement made by incransom claims that over 12,000 IDs and passports belonging to citizens of various countries were taken. While the specific volume of files and the exact ransom demand remain unknown, the group has provided visual evidence to support its claims. The screenshots provided in the leak site post display blurred samples of various documents, which are intended to demonstrate the nature of the stolen information.

The specific types of data mentioned in the listing include:

• Identity documents
• Passport information

About Coop57

Coop57 is a cooperative financial institution operating on the principles of social and solidarity economy. The organization aims to meet the financial needs of citizens and social economy actors. As part of a network of microfinance organizations and federations, it develops alternative economic models to support its mission within the financial services sector.

Analysis and potential impact

This incident may pose a risk of identity theft for the organization's customers and employees due to the sensitive nature of the documents claimed to have been stolen. Because the organization operates in Spain, administrative sanctions under GDPR may be considered if the breach is verified. The exposure of identity documents and passport information provides malicious actors with the necessary tools to impersonate individuals, potentially leading to fraudulent activities and long-term complications for the affected citizens.

The use of double extortion tactics by the incransom group suggests that the organization could become susceptible to targeted phishing attacks following the publication of the data. When attackers possess specific details about an organization's operations or its clients, they can craft highly convincing social engineering campaigns. These attacks often target employees or customers to gain further access to systems or to extract more sensitive information through deception.

A data breach involving a financial services entity may create negative impacts on customer trust. In the financial sector, the security of personal and identity information is a cornerstone of the relationship between the institution and its clients. When such data is compromised, it can lead to significant reputational damage. While information about the incransom group remains limited, the threat they pose through data exposure highlights the ongoing risks faced by financial institutions globally.

To mitigate such risks, organizations in the financial sector often implement multi-layered defense strategies. This includes robust encryption for data at rest and in transit, strict access controls, and continuous monitoring of network activities to detect unauthorized exfiltration. Furthermore, regular security awareness training is essential to help employees recognize and avoid the phishing attempts that often follow a data leak. Strengthening incident response plans is also a critical step in managing the fallout of a potential breach and minimizing the impact on stakeholders.