Inc Ransom ransomware group lists alupco.com on its leak site

• Ransomware group: Inc Ransom
• Country: Saudi Arabia
• Sector: Manufacturing
• Announcement date: April 17, 2026

The Inc Ransom ransomware group has published an announcement on its leak site claiming that alupco.com has been targeted in a cyberattack. The listing, which appeared on April 17, 2026, suggests that the organization's data has been compromised. This development follows a pattern observed in modern ransomware operations where threat actors use public leak sites to pressure victims into paying ransoms by threatening to release stolen information.

Details of the alleged attack

According to the claims made by the Inc Ransom group, the attack against alupco.com occurred on April 13, 2026. The group has publicly listed the organization, noting its annual revenue as 56.4 million dollars. This type of information is frequently used by ransomware groups to establish the financial capacity of their targets, potentially to justify higher ransom demands.

The group claims to have exfiltrated a specific number of files from the victim's network. While the exact volume of the data in terms of total size has not been provided, the group asserts that 787 files have been stolen. The announcement was categorized as a data leak, indicating that the threat actors intend to use the stolen information as leverage.

Data at risk

The specific content of the leaked data has not been explicitly detailed in the group's announcement. However, visual evidence provided by the attackers, such as icons present in their screenshots, suggests that corporate and financial data may be at risk. The lack of specific details regarding the exact files or the nature of the information remains a significant concern for the affected entity.

• Corporate data
• Financial data

The listing does not name any specific individual data types or provide a granular breakdown of the stolen information beyond the file count.

About alupco.com

ALUPCO is a major player in the industrial sector, established in 1975. It holds the position of the largest aluminium extruder in the Middle East. The company's operations involve the manufacturing of high-quality aluminium profiles and the provision of various architectural solutions and modular building projects.

Impact and industry implications

This alleged data leak could have significant negative impacts on the institution's operational continuity and its commercial reputation. Given that the Inc Ransom group utilizes a double-extortion method, there is a high probability that the exfiltrated data will be published publicly if the ransom is not paid. In double-extortion schemes, attackers not only encrypt systems to disrupt operations but also steal sensitive data to use as blackmail.

Because the organization maintains international operations, this breach may lead to complex compliance issues regarding local data protection regulations in various countries where they operate. Furthermore, if the leaked data happens to include employee information or customer contracts, the organization might face secondary threats such as identity theft or targeted phishing attacks directed at third parties.

In the manufacturing sector, such incidents underscore the importance of robust cybersecurity frameworks. Organizations in this sector typically focus on protecting intellectual property and maintaining supply chain integrity. Common defensive steps for organizations include implementing multi-factor authentication, maintaining offline backups, and conducting regular security awareness training to mitigate the risk of initial access through phishing or other common vectors.

Limited information on the threat actor

At this time, information regarding the specific identity and technical capabilities of the Inc Ransom group remains limited. The group continues to be a subject of interest for threat intelligence analysts monitoring ransomware trends.