Inc Ransom claims data breach against goldair.gr

• Ransomware group: Inc Ransom
• Country: Greece
• Sector: Transportation
• Announcement date: January 23, 2026

Inc Ransom claims to have stolen data from goldair.gr

The ransomware group known as Inc Ransom has posted a notice on its leak site claiming to have targeted the Greece-based organization goldair.gr. According to the announcement, the group asserts that they have successfully compromised the company's systems and obtained a significant volume of data. This claim was officially posted to the group's platform on January 23, 2026.

The threat actor has reportedly issued a 72-hour ultimatum to the organization. This type of pressure tactic is a hallmark of modern ransomware operations, where attackers attempt to force a victim into compliance by threatening the public release of sensitive information within a strict timeframe. As of the announcement, the group has not disclosed a specific ransom demand, leaving the financial requirements for non-disclosure unknown.

Details of the alleged data theft

The Inc Ransom group claims to have exfiltrated a massive amount of information from the victim's infrastructure. Specifically, the group alleges that the total size of the stolen data is 1 TB. Despite the significant volume claimed by the attackers, the announcement lacks a detailed breakdown regarding the specific contents or the exact nature of the files involved. No information was provided regarding the specific file count or a granular inventory of the compromised datasets.

The listing identifies the following type of affected information:

• Personal data

Profile of goldair.gr

Goldair is a prominent group based in Greece that operates within the aviation ground handling and international logistics and freight forwarding sectors. The company's operations are divided into specialized divisions to serve the transportation industry. Through its Goldair Handling division, the group provides essential ground handling services at various airports.

In addition to aviation services, the group operates Goldair Cargo, which focuses on providing comprehensive logistics solutions. These solutions encompass a wide range of transport methods, including road, air, and sea transport, positioning the company as a multifaceted player in the international logistics landscape.

Implications and potential risks

This alleged breach carries several significant risks for the organization and its stakeholders. For the employees and business partners of Goldair, the compromise of personal data may lead to secondary threats, such as identity theft or highly targeted phishing attacks. Such attacks often leverage stolen information to gain further access to corporate networks or to defraud individuals.

Furthermore, because the company is headquartered in Greece, a confirmed breach could trigger serious legal and regulatory consequences. Under the General Data Protection Regulation (GDPR), organizations found to be in violation of data protection standards may face substantial administrative fines and legal sanctions. The potential for such regulatory scrutiny adds a layer of complexity to the incident response process.

The tactics employed by Inc Ransom are consistent with the concept of double extortion. In these scenarios, attackers do not just encrypt data to disrupt operations; they also steal sensitive information to use as leverage, threatening to leak it to damage the victim's commercial reputation. This method is designed to maximize pressure on an organization by targeting its public image and its operational continuity simultaneously. Given that Inc Ransom has been active since 2023 and is known for using these specific pressure methods, the situation highlights the necessity for organizations in the transportation and logistics sectors to maintain robust data security measures and have well-defined data breach response protocols ready for implementation.