Inc Ransom claims data breach against ros.eu

• Ransomware group: Inc Ransom
• Country: Germany
• Sector: Technology
• Announcement date: May 16, 2025

Inc Ransom claims to have compromised ros.eu

The Inc Ransom ransomware group has published an announcement on its leak site claiming responsibility for a cyberattack targeting ros.eu. According to the post published on May 16, 2025, the threat actor group alleges that they have successfully compromised the systems of the organization and extracted a significant amount of information.

This incident follows a common pattern observed in modern cybercrime, where ransomware groups utilize leak sites to pressure victims. These sites serve as a public platform for the attackers to announce their successful breaches, often providing details about the victim and the volume of data stolen to increase the pressure on the targeted entity.

Details of the alleged attack and data theft

The announcement made by Inc Ransom on May 16, 2025, claims that the group has obtained 450 GB of data from the institution's systems. While the group has provided a specific volume for the stolen data, they have not provided any information regarding a ransom demand or the specific number of files involved in the breach.

The leaked information is reported to include sensitive details that could impact both the company and its personnel. The specific types of data mentioned in the claim include:

• Employee contact information
• Corporate data

The inclusion of employee phone numbers and corporate information in the leak poses a direct threat to the privacy of the individuals involved. When personal contact details are exposed, it significantly increases the risk that these individuals will be targeted by subsequent, highly specific attacks. Such attacks often involve phishing or social engineering, where attackers use the stolen information to gain trust and manipulate the victim into revealing further credentials or facilitating further unauthorized access.

About ros.eu

The target of this alleged attack, ros.eu, is a German-based organization operating within the technology sector. Specifically, IEM Fördertechnik GmbH is a German manufacturer specializing in idler rollers, motor rollers, expansion elements, and accessories for conveying technology systems.

Potential risks and implications

The claim made by Inc Ransom carries several significant implications for the organization. Given that ros.eu operates in Germany, the exposure of employee and corporate data may fall under the scope of the General Data Protection Regulation (GDPR). This regulatory framework often triggers formal legal processes and mandatory reporting requirements following a data breach involving personal information.

Furthermore, the incident highlights the risks associated with the double-extortion tactic frequently employed by ransomware groups. In a double-extortion scenario, attackers do not merely encrypt a company's data to disrupt operations; they also steal sensitive information to use as leverage. The threat of publishing or selling this data on the dark web creates secondary risks for the institution, including potential reputational damage and significant financial penalties resulting from regulatory non-compliance.

For organizations operating in the technology and manufacturing sectors, such incidents underscore the necessity of robust cybersecurity postures. Defensive strategies typically include maintaining rigorous backup protocols, implementing multi-factor authentication, and conducting regular security awareness training to mitigate the risks of social engineering. Protecting the continuity of operations and safeguarding employee privacy remains a critical priority for industrial manufacturers facing evolving cyber threats.