Skip to content
Ransomware

INC Ransom ransomware group lists deerfield.com (singulargenomics.com) on its leak site

The INC Ransom group claims to have leaked 20 TB of data allegedly belonging to Singular Genomics on their leak site.

By
Siberpol Intelligence Unit
Published
3 min read
3 min read
  • Ransomware group: INC Ransom
  • Country: United States
  • Sector: Technology
  • Announcement date: December 18, 2025

INC Ransom claims massive data exfiltration from Singular Genomics

The threat actor known as INC Ransom has announced on its leak site that it has successfully compromised the systems of Singular Genomics. According to the group's announcement, the breach involves a massive volume of data, with the group claiming to have obtained approximately 20 TB of information from the organization. This announcement, made on December 18, 2025, marks a significant escalation in the group's activities targeting the technology sector.

The group's post alleges that the breach was made possible because the institution has been negligent regarding its data security measures. As a result of this alleged negligence, the threat actors claim they will proceed to publish the stolen information. This tactic is a hallmark of modern ransomware operations, where the focus has shifted from merely encrypting files to the theft of sensitive information to increase leverage over the victim.

Details of the alleged data theft

The information allegedly exfiltrated by INC Ransom is extensive and covers multiple critical areas of the organization's operations. The group claims to have accessed highly sensitive materials that could impact the company's intellectual property and operational integrity. The scope of the stolen data is said to include various categories of information, ranging from technical assets to sensitive personal details.

According to the claims made by the threat actor, the following types of data have been compromised:

  • Source codes
  • Biological data
  • Experimental data
  • Client data
  • Personally identifiable information (PII)
  • Staff data
  • Financial data
  • Proposal contracts
  • NDAs
  • Internal documents

The breadth of this list suggests that the attackers targeted a wide array of digital assets, from core proprietary technology to administrative and human resources records.

About Singular Genomics

Singular Genomics is a life science technology company that specializes in the development of next-generation sequencing (NGS) and multiomics technologies. The company is a key player in the biotechnology sector, producing high-speed and accurate genomic analysis tools. One of their primary offerings is the G4 Sequencing Platform, which is designed to assist researchers and clinicians in performing complex genomic analysis.

Analysis and potential impact of the breach

INC Ransom is a ransomware group that emerged in mid-2023 and is known for employing double-extortion tactics. In a double-extortion scenario, attackers not only encrypt an organization's data to disrupt operations but also steal sensitive data to threaten the victim with its public release. This method significantly increases the pressure on organizations to pay ransoms, as the threat of data exposure can lead to severe reputational and legal consequences.

The breach at Singular Genomics may jeopardize the organization's intellectual property and client confidentiality. Specifically, the exposure of biological data could pose long-term risks to the organization's research processes, potentially undermining years of scientific investment. Furthermore, because the organization is a US-based entity, this incident may trigger legal processes under relevant state laws and sectoral regulations regarding data breach notifications.

The leak of personal and financial data also introduces secondary risks, such as identity theft or targeted phishing attacks directed at employees and customers. In such scenarios, attackers often use the stolen information to craft highly convincing social engineering campaigns. To defend against such threats, organizations in the life sciences and technology sectors often implement multi-layered security strategies, including robust encryption, strict access controls, and continuous monitoring of network traffic to detect unauthorized data exfiltration.

Threat Intelligence

Track ransomware groups, victim posts and indicators of compromise, and see the records that match your own assets.

Related stories