Inc Ransom claims data breach against earthsystems.com.au and earthsystemseurope.com

• Ransomware group: Inc Ransom
• Country: Australia
• Sector: Professional Services
• Announcement date: May 8, 2026

Inc Ransom claims data breach against earthsystems.com.au and earthsystemseurope.com

The threat actor known as Inc Ransom has listed earthsystems.com.au and earthsystemseurope.com on its leak portal. The group claims to have obtained corporate data belonging to these specific entities, marking a new potential victim for the ransomware group.

Details of the alleged attack

According to the announcement made on May 8, 2026, Inc Ransom has published a listing targeting the aforementioned domains. The group claims to have successfully exfiltrated corporate data from these organizations. In the post, the threat actor specified the organization's annual revenue as 20 million dollars and provided various document samples as evidence to support their claims.

The timeline provided by the group suggests the claimed attack occurred on May 3, 2026. While the group has posted these claims on their leak site, the specific details regarding the total volume of data stolen or the exact ransom demand remain unknown, as no information was provided regarding the data size, file count, or ransom amount.

Alleged data types and content

The screenshots provided by the threat actor as evidence contain documents that allegedly include sensitive corporate information. The contents of the leaked material are said to include:

• Non-disclosure agreements (NDA)
• Client contracts
• Project documents
• Corporate data

The presence of such documents, including client contracts and project files, suggests that the breach could impact the confidentiality of business relationships and ongoing professional engagements.

About Earth Systems

Earth Systems is an engineering and environmental science firm providing consulting services in environmental and social sustainability, water management, and the mining sector. Based in Australia, the company specializes in environmental impact assessments and sustainable development solutions for international projects.

Analysis and potential implications

Inc Ransom is recognized as a ransomware group that has been employing double-extortion tactics since mid-2023. In double-extortion schemes, attackers not only encrypt an organization's data but also steal it, threatening to release it publicly if a ransom is not paid. This tactic significantly increases the pressure on victims, as the threat of data exposure can cause irreparable reputational and legal damage.

This alleged breach may lead to the exposure of the organization's trade secrets and client information. Given that the entity is based in Australia, a potential data breach could result in legal consequences under the Australian Privacy Act. Furthermore, the leaked data may facilitate targeted phishing attacks against the organization's clients or introduce supply chain risks. If the ransom demand is not met, it is possible that the exfiltrated data will be made public, following the group's established patterns.

For organizations operating in the professional services and engineering sectors, maintaining robust cybersecurity postures is critical. This includes implementing strict access controls, conducting regular security audits, and ensuring comprehensive employee training to recognize phishing attempts. Protecting sensitive client contracts and project documentation is essential to maintaining trust and meeting regulatory requirements.