Inc Ransom ransomware group lists acwapower.com \ https://www.larsentoubro.com/ on its leak site

• Ransomware group: Inc Ransom
• Country: Saudi Arabia
• Sector: Energy & Utilities
• Announcement date: February 24, 2026

Inc Ransom claims data breach at Acwa Power and Larsen & Toubro

The ransomware group known as Inc Ransom has listed acwapower.com and larsentoubro.com on its leak site. In an announcement posted on February 24, 2026, the threat actor claimed to have exfiltrated 400 GB of data from these organizations. The group's claims suggest a significant breach involving critical corporate information.

Details of the claimed attack

According to the post made by Inc Ransom, the breach occurred around February 15, 2026. The group claims to have successfully breached the networks of both acwapower.com and larsentoubro.com, leading to the acquisition of a large volume of data. The threat actor is reportedly employing a double-extortion strategy. This common ransomware tactic involves not only encrypting a victim's systems to disrupt operations but also stealing sensitive data beforehand. The group then threatens to publish or sell the exfiltrated information on the dark web if their demands are not met, placing immense pressure on the targeted entities.

While the group has announced the theft, they have not disclosed a specific ransom demand. The announcement serves as a notification of the breach and a tool for extortion, leveraging the threat of public exposure to coerce the organizations.

Scope of the leaked data

The information provided by the group includes screenshots that appear to show various documents. These samples contain the logos of both ACWA Power and Larsen & Toubro, suggesting the files originated from their respective corporate environments. Although the group has not provided a detailed inventory or a complete breakdown of every file stolen, the available samples indicate the presence of corporate operational documentation. The data allegedly stolen includes:

• Corporate operational documents
• Technical reports
• Project documentation

The presence of such documents, which include technical manuals and safety rules, suggests that the breach may have touched upon sensitive internal processes and project-specific details.

Potential implications and defensive considerations

The claims made by Inc Ransom could pose significant risks to the operational continuity and commercial reputation of the affected organizations. The inclusion of technical reports and project documentation in a potential leak could lead to negative consequences regarding intellectual property and competitive advantage. Furthermore, the use of such data in secondary attacks, such as targeted phishing campaigns, remains a possibility for the threat actors.

The double-extortion method also increases the likelihood of organizations facing legal sanctions under various data privacy regulations, depending on the nature of the stolen information. Given that Inc Ransom has been active since 2023 and follows established patterns of operation, such incidents highlight the ongoing necessity for organizations to maintain robust security postures. To mitigate these risks, it is often necessary for organizations to conduct thorough forensic investigations to determine the actual scope of a breach and to review their existing security measures to prevent future unauthorized access.