Fund for Reformed Companies (FONPER) listed on incransom leak site

• Ransomware group: incransom
• Country: Dominican Republic
• Sector: Financial Services
• Announcement date: June 25, 2025

incransom claims attack on Dominican state institution

The Fund for Reformed Companies (FONPER), a prominent state institution in the Dominican Republic, has been listed on the leak site of the ransomware group known as incransom. According to an announcement made by the threat actor, the organization has been targeted in a cyberattack, marking a significant potential breach for the Dominican state entity.

The incransom group published a post on June 25, 2025, claiming that they have successfully gained access to the internal systems of the institution. While the announcement was made in late June, the group asserts that the actual attack occurred earlier, specifically on June 17, 2025. This timeline suggests a period of unauthorized access prior to the public listing on their leak site.

Details regarding the alleged data breach

Despite the listing on the group's leak site, the attackers have not provided specific details regarding the nature of the allegedly leaked data. There is currently no information available concerning the volume of files involved or the total size of the data that may have been exfiltrated during the incident. Furthermore, the group has not disclosed any specific ransom demands or the specific types of files that were targeted during the operation.

The listing names no data types.

About the Fund for Reformed Companies (FONPER)

The Fund for Reformed Companies (FONPER) is an institution of the Dominican State. Established in 2001, the institution is responsible for managing, safeguarding, and overseeing the State's shares in companies that emerged from the reform and transformation process.

Threat assessment and potential implications

The incransom group is a threat actor that emerged in mid-2023 and is known for employing double extortion tactics. In a double extortion scenario, attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage, threatening to leak it publicly unless a ransom is paid. This method increases the pressure on victims, as the threat of data exposure can cause significant reputational and legal damage.

Because the victim is a state institution, the potential leak of sensitive data may lead to the disruption of public services or damage to administrative processes. Depending on the content of the leaked data, secondary risks such as identity theft and targeted phishing attacks against employees or associated parties may be observed. Furthermore, the institution may face legal obligations under the data protection regulations in the Dominican Republic.

Given the past activities of the incransom group, it is assessed that processes such as the publication of data or pressure through ransom demands may continue. Organizations in the financial and state sectors often face these types of sophisticated threats, which necessitate robust defensive measures. Common defensive strategies for organizations include maintaining offline backups, implementing strict access controls, and conducting regular security awareness training to mitigate the risk of initial access through phishing or other common vectors.