Harrison Design listed on incransom leak site with claims of data exfiltration

• Ransomware group: incransom
• Country: United States
• Sector: Professional Services
• Announcement date: January 12, 2026

Incransom claims data breach against Harrison Design

The ransomware group known as incransom has listed the United States-based firm Harrison Design on its dedicated leak site. According to the announcement made on January 12, 2026, the threat actors claim to have successfully exfiltrated a significant volume of data belonging to the organization. The group alleges that the total size of the stolen data amounts to 100 GB.

The incident involves what appears to be a targeted attack aimed at acquiring sensitive corporate information. In such scenarios, ransomware groups often utilize a tactic known as double extortion. This method involves not only encrypting an organization's internal systems to disrupt operations but also stealing sensitive data beforehand. The threat actors then threaten to publish this stolen information on public leak sites if the ransom demands are not met, thereby exerting maximum pressure on the victim organization.

The group's announcement asserts that the compromised information includes various operational and financial documents. This type of breach can cause significant disruption to a company's internal workflows and financial management processes.

The scope of the claimed data theft

The information allegedly stolen by the incransom group is extensive and covers multiple facets of the firm's business operations. Based on the claims made by the attackers, the leaked data is said to include a wide variety of sensitive materials that could impact both the firm and its professional relationships. The stolen content reportedly encompasses:

• Confidential documents
• Client data
• NDAs
• Financial data
• Operations
• Corporate data
• Business agreements
• Development files
• Architectural drawings

The inclusion of architectural drawings and business agreements is particularly notable, as these files often represent the core intellectual property of a design firm. Such data is highly sensitive and can be used by competitors or malicious actors to undermine the firm's market position.

About Harrison Design

Harrison Design is an award-winning design firm that specializes in several key areas of the built environment. Their expertise covers architecture, interior design, and landscape architecture. The firm provides professional services across a diverse range of sectors, catering to residential, multifamily, sacred, and hospitality projects.

Impact and risk assessment

The potential consequences of this breach are multifaceted. Given the double-extortion tactics employed by the incransom group, the publication of this data may increase the risk of identity theft or targeted phishing campaigns for the firm's clients and partners. When client data and NDAs are exposed, the trust between a service provider and its clients is often severely tested, and the risk of secondary attacks against those clients increases significantly.

As a United States-based entity, this incident may lead to legal scrutiny under state-level privacy laws and relevant sectoral regulations. Organizations facing such threats must navigate complex regulatory landscapes to ensure they are meeting their legal obligations regarding data protection and breach notification. Furthermore, the exposure of architectural drawings and business agreements could potentially compromise the firm's intellectual property and weaken its competitive position in the design industry.

The incransom group has been active since mid-2023. Based on their historical activity, it is assessed that they may continue to utilize similar attack patterns to leverage corporate data for extortion. To defend against such threats, organizations in the professional services sector often implement defensive measures such as multi-factor authentication, robust endpoint protection, regular data backups, and comprehensive employee training to recognize phishing attempts. Maintaining strict access controls and monitoring for unusual data exfiltration patterns are also critical components of a modern cybersecurity posture.