Inc Ransom claims data breach against coruzcitywndata+

• Ransomware group: Inc Ransom
• Country: United States
• Sector: Manufacturing
• Announcement date: July 1, 2025

Inc Ransom claims to have stolen data from Thomasville

The threat actor known as Inc Ransom has published an announcement on its leak site claiming to have compromised significant amounts of data belonging to the city of Thomasville. According to the group's claims, the breach involves a substantial volume of information, which the group asserts is approximately 250 GB in size. This announcement, made on July 1, 2025, marks a recent development in the activity of this threat group.

The incident involves the city of Thomasville, a local government entity. While the group has claimed to have successfully exfiltrated data, the specific details regarding the method of entry or the exact nature of the breach have not been provided in the announcement. The group's claim centers on the possession of sensitive administrative and financial records that are critical to the functioning of a municipal government.

Details of the claimed data theft

The Inc Ransom group has provided several screenshots as evidence to support their claims of a successful data exfiltration. These visual proofs are intended to demonstrate the depth of their access to the organization's internal systems. Based on the information provided by the threat actor, the stolen data is not limited to a single category but spans various administrative and financial domains.

The screenshots shared by the group reportedly display a variety of sensitive documents. These include spreadsheets detailing city budgets and various service payment records. Furthermore, the leaked information is said to include technical drawings and various other administrative financial documents that are essential for the day-to-day operations of the municipality.

The specific types of data mentioned in the claim include:

• Financial data
• Administrative service records
• Technical drawings

About the target organization

The target of this alleged attack is Thomasville, which is a city located in Davidson County, North Carolina, in the United States. Thomasville is a local government entity that holds significant historical importance in the region, particularly being known for its involvement in the furniture industry.

Analysis and implications of the threat

This leak presents a significant risk due to the exposure of sensitive financial data held by a local government unit. Attacks targeting local governments in the United States can lead to serious disruptions in public services and create the potential for the misuse of citizens' personal information. Given the double-extortion tactics frequently employed by the Inc Ransom group, the publication of such data can trigger secondary risks, including identity theft and highly targeted phishing campaigns directed at the public or the organization's employees.

Furthermore, the institution may face complex legal obligations under North Carolina state laws and federal data protection standards following such an incident. The Inc Ransom group, which has been active since mid-2023, continues to highlight the critical importance of robust digital infrastructure security for public institutions. Such incidents underscore the necessity for government entities to implement comprehensive defensive measures.

In the context of modern cyber threats, ransomware groups often use double extortion, where they not only encrypt an organization's data but also threaten to leak it publicly to increase pressure for payment. To defend against such tactics, organizations in the public sector and manufacturing sectors should prioritize several defensive steps. This includes maintaining offline, immutable backups of critical data to ensure recovery without paying a ransom. Additionally, implementing strict access controls, multi-factor authentication (MFA), and continuous monitoring of network traffic can help detect and mitigate unauthorized access before data exfiltration occurs. Regular security audits and employee training regarding phishing awareness are also vital components of a modern cybersecurity posture.