Humax Holdings targeted by Inc Ransom in alleged data breach

• Ransomware group: Inc Ransom
• Country: South Korea
• Sector: Technology
• Announcement date: September 17, 2025

Inc Ransom claims data breach at Humax Holdings

The ransomware group known as Inc Ransom has published an announcement on its dedicated leak site, claiming to have compromised data belonging to Humax Holdings. The announcement, which appeared on the group's leak site on September 17, 2025, suggests that the threat actor group has successfully executed a cyberattack against the South Korean organization. While the group claims to have conducted the attack on September 16, 2025, the specific details regarding the volume of data stolen or the specific ransom demands have not been disclosed in the public announcement.

Ransomware leak sites are platforms used by cybercriminal groups to exert pressure on victims. These sites often host lists of targeted organizations and, in many cases, provide samples of stolen data to prove the validity of the breach. This tactic is a core component of modern cyber extortion, where the threat of public exposure is used as leverage to compel organizations into paying large sums of money.

Details of the alleged attack

According to the claims made by Inc Ransom, the group has gained unauthorized access to the internal systems of Humax Holdings and has successfully exfiltrated various types of sensitive information. The group has asserted that they possess a wide array of critical documentation that could be highly damaging if released. To support their claims, the group provided screenshots as part of the announcement, which reportedly include samples of various documents and data presented in spreadsheet formats.

The group's claims regarding the specific types of information compromised include:

• Fiscal data
• Internal emails
• Employee data
• Strategic development plans

The nature of these claims suggests a significant breach of corporate confidentiality. When a group claims to possess internal emails and strategic plans, it indicates that the attackers have moved beyond simple encryption and have engaged in data exfiltration, a hallmark of advanced ransomware campaigns.

About Humax Holdings

Humax Holdings is a prominent holding company based in South Korea. The organization manages a diverse portfolio of subsidiaries that operate across several critical technology and media sectors. Specifically, the company's interests include broadcasting and telecommunications gateways, digital broadcasting software, and various mobility solutions. The company has a long history in the industry, having been founded in 1989, and it transitioned to its current holding company structure in 2009.

Risks and implications of the breach

This incident poses several significant risks to Humax Holdings. The exposure of sensitive corporate and personal data can lead to a variety of secondary consequences. For instance, the disclosure of employee information creates a high risk of targeted phishing attacks against the affected personnel, as attackers can use personal details to craft highly convincing social engineering schemes. Furthermore, the potential release of strategic development plans and fiscal data could result in a loss of competitive advantage and substantial reputational damage for the company.

From a regulatory perspective, the organization may face legal sanctions under the data protection regulations applicable in South Korea. Given the double-extortion tactics frequently employed by groups like Inc Ransom—where data is both encrypted and stolen to ensure maximum leverage—there is a high likelihood that the leaked data may continue to be shared publicly if the ransom demands are not met. Information regarding the Inc Ransom group remains limited, as the group only emerged in mid-2023.

In such scenarios, organizations in the technology and telecommunications sectors often focus on strengthening their defensive postures. This typically involves implementing robust data loss prevention (DLP) measures, enhancing endpoint detection and response (EDR) capabilities, and conducting regular security awareness training to mitigate the risk of phishing. Additionally, maintaining rigorous backup protocols and ensuring that sensitive data is encrypted both at rest and in transit are standard industry practices to defend against such exfiltration tactics.