Evolve Mortgage Services listed on Inc Ransom leak site

• Ransomware group: Inc Ransom
• Country: United States
• Sector: Financial Services
• Announcement date: October 30, 2025

Evolve Mortgage Services has been listed on the Inc Ransom leak site, with the threat actor group claiming to have exfiltrated 20 TB of company data. The announcement, made on October 30, 2025, marks a significant escalation in the ongoing pressure exerted by ransomware groups against financial institutions.

The claims made by Inc Ransom

The Inc Ransom group has published an announcement on their dedicated leak site regarding Evolve Mortgage Services. According to the threat actor, the group has obtained a massive volume of data, specifically claiming to have exfiltrated 20 TB. The group alleges that this breach occurred because the company refused to resolve security-related demands made by the attackers.

The claims regarding the scope of the breach are extensive. The threat actor states that the compromised data includes records belonging to all clients from both companies involved, with the data reportedly dating back as far as 2016. This long-term retention of information is a central component of the group's claim, suggesting a deep penetration into historical archives.

The alleged leaked data

The information allegedly stolen by the group is highly sensitive, containing a variety of personally identifiable information (PII) and financial records. Based on the samples provided by the attackers, the leaked data is said to include various spreadsheets and documents containing critical financial information. The specific types of data mentioned in the listing include:

• Social Security Numbers (SSN)
• ID scans
• Address information
• Phone numbers
• Credit history records

The presence of such diverse data types, ranging from government identifiers to detailed financial histories, represents a significant security incident for the affected entity and its clientele.

About Evolve Mortgage Services

Evolve Mortgage Services is a financial services company operating in the residential mortgage and lending services sector. The company provides solutions for mortgage processing and loan management, serving a critical role in the financial infrastructure for residential lending.

Analysis and implications

This alleged breach may pose a significant risk of identity theft and fraud for the company's clients. Given that the entity is based in the United States, the incident could lead to legal repercussions under state-level data protection laws and federal regulations. The exposure of such sensitive information often triggers mandatory notification requirements to both regulators and affected individuals.

Considering the double-extortion tactics typically employed by Inc Ransom, the publication of this data could damage the company's reputation and expose customers to targeted phishing attacks. Double extortion is a common ransomware strategy where attackers not only encrypt a victim's systems but also steal sensitive data, threatening to leak it on public forums if the ransom is not paid. This adds a layer of pressure that focuses on reputational damage and regulatory scrutiny.

Furthermore, the retention of data dating back to 2016 may be viewed as a potential violation of data minimization principles. Data minimization is a core concept in modern cybersecurity and privacy frameworks, suggesting that organizations should only retain the personal information necessary for their specific purposes. Keeping decades of client data increases the