Inc Ransom ransomware group lists deerfield.com / singulargenomics.com on its leak site

• Ransomware group: Inc Ransom
• Country: United States
• Sector: Technology
• Announcement date: September 11, 2025

Inc Ransom claims massive data exfiltration against Deerfield and Singular Genomics

The ransomware group known as Inc Ransom has published an announcement on its leak site claiming responsibility for a significant data breach targeting Deerfield Management and Singular Genomics. According to the group's claims, the breach resulted in the theft of a massive volume of data, totaling approximately 20 terabytes. This announcement, posted on September 11, 2025, follows an alleged attack date of September 10, 2025.

Ransomware groups often utilize leak sites to pressure victims into paying ransoms. This process frequently involves a tactic known as double extortion, where attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive information. By threatening to release this stolen data publicly, the threat actors create additional leverage, aiming to cause reputational or regulatory damage to the victim organization to compel payment.

Details of the alleged breach and stolen data

The threat actor claims to have successfully breached the systems of both Deerfield Management and Singular Genomics. The group asserts that the data was downloaded from various sources, specifically mentioning servers and Amazon storage environments. The scale of the alleged exfiltration is substantial, with the group claiming to have moved 20 terabytes of information from the target networks.

The content of the allegedly stolen data is highly sensitive, spanning various technical and scientific domains. The group claims to possess information that could be vital to the operations and intellectual property of the targeted entities. The specific types of data mentioned in the claim include:

• Experimental data
• Software source codes
• AI data
• Research data

Furthermore, the group claims that the stolen information includes research projects, software source codes, and data belonging to a variety of business partners. The scope of the breach appears to extend beyond the primary targets, potentially impacting several high-profile collaborators. The group specifically named Fox Chase, GeneDX, Juno, Lexogen, Harvard, and Siemens as partners whose research data may have been compromised in this incident.

Potential impact and industry implications

The alleged breach carries significant implications for the targeted organizations, particularly regarding their intellectual property and trade secrets. Because the claims involve highly specialized fields such as biotechnology and genetic engineering, the disclosure of such sensitive information could lead to long-term competitive risks. In these sectors, proprietary research and development data often constitute the core value of the enterprise.

Given that the organizations involved are based in the United States, such an incident may trigger legal and regulatory scrutiny. The loss of sensitive data can lead to violations of data privacy obligations under various state laws and federal regulations. Organizations in these highly regulated sectors must often navigate complex compliance frameworks to protect patient and research data.

The use of double-extortion tactics by groups like Inc Ransom increases the risk profile for the victims. Even if an organization can restore its systems from backups, the threat of a data leak remains. Stolen data can be repurposed by attackers for secondary attacks, such as highly targeted phishing campaigns or social engineering efforts against employees and partners. While information regarding the specific capabilities and history of Inc Ransom remains limited, the nature of their claims suggests a focus on high-value data exfiltration.

To mitigate such risks, organizations in the technology and biotechnology sectors generally focus on strengthening their defensive posture. This includes implementing robust access controls, monitoring for unauthorized data transfers, and ensuring that cloud storage environments, such as Amazon storage, are properly secured. Maintaining a comprehensive incident response plan and ensuring regular backups are essential components of modern cybersecurity defense strategies.