Della Casa Group AG listed on incransom leak site

• Ransomware group: incransom
• Country: Switzerland
• Announcement date: July 28, 2026

Swiss construction firm Della Casa Group AG targeted by incransom

The Switzerland-based construction and real estate development company, Della Casa Group AG, has been listed on the leak site of the ransomware group known as incransom. The group announced the incident on July 28, 2026, claiming to have successfully compromised the organization's systems and exfiltrated a significant volume of sensitive information.

Details of the claimed attack

According to the claims made by incransom, the group gained unauthorized access to the systems of Della Casa Group AG. The threat actor alleges that they have obtained approximately 240 GB of data, consisting of 86,332 files. The announcement of this breach occurred on July 28, 2026, which aligns with the date the group claims the attack took place.

In an attempt to exert pressure for a ransom payment, the group has begun sharing various corporate documents and the contact details of employees. This tactic is a hallmark of modern ransomware operations, where the threat actor uses the threat of public exposure to coerce the victim into meeting financial demands. While the specific amount of the ransom demand has not been disclosed, the group's actions follow a pattern of using stolen information as leverage during negotiations.

Data types and information involved

The leaked information is said to include a wide range of sensitive materials. Based on the details provided by the group, the data involves personal and client information, as well as critical business records. The group has provided screenshots that show samples of the documents they claim to have stolen. The specific categories of affected data include:

• Personal data
• Client information
• Accounting records
• Financial data
• Project documents

The exposure of such data, particularly regarding current and future projects, suggests that the breach could impact the company's strategic operations and competitive standing.

Organization profile

Della Casa Group AG is a Swiss-based construction and real estate development company. The company operates in the planning, development, and management of residential and commercial projects.

Potential impact and risk assessment

This incident may increase the risk of identity theft or targeted phishing attacks against the employees and clients of Della Casa Group AG. Because the organization is based in Switzerland, the breach may trigger legal obligations under the Federal Act on Data Protection (FADP). The exposure of financial and project-related data could lead to the loss of trade secrets and compromise the company's competitive position.

Given the double-extortion tactics typically employed by the incransom group, the company may face both operational disruptions and significant reputational damage. Double extortion involves not only encrypting a victim's data to disrupt operations but also stealing the data to threaten its public release. This approach forces organizations to fight a two-front battle: recovering from system downtime and managing the fallout of a data leak.

Past activities of this group suggest that such leaks often occur when ransom demands remain unmet. When organizations implement defensive measures and refuse to comply with extortion attempts, groups like incransom often escalate the situation by publishing data on their public leak sites. This highlights the ongoing challenge organizations face in managing cyber risks and the potential for prolonged reputational damage following a successful exfiltration event.