Inc Ransom ransomware group lists doradosoftware.com on its leak site

• Ransomware group: Inc Ransom
• Country: United States
• Sector: Technology
• Announcement date: June 21, 2025

Inc Ransom claims data breach at Dorado Software

The threat actor known as Inc Ransom has published a leak announcement on its dedicated leak site, claiming that data belonging to the United States-based organization doradosoftware.com has been compromised. The announcement, which appeared on June 21, 2025, suggests that the breach occurred around June 16, 2025. While the group has posted this claim, the incident remains an allegation made by the threat actor via their public leak platform.

Ransomware groups frequently utilize leak sites to pressure victims into paying ransoms. These platforms serve as a public gallery for the groups' activities, where they post names of targeted organizations and, in some cases, samples of stolen data. This practice is a hallmark of modern cyber extortion, designed to maximize the reputational damage and operational pressure exerted on the victim company.

Details of the claimed incident

According to the announcement released by Inc Ransom, the breach involves sensitive information related to the company's operations. The threat actor specifically noted that the company provides specialized solutions for network management and automation, implying that the stolen data may be linked to these core business functions. In addition to operational information, the group has shared personal contact information belonging to the company's employees within the post.

The group's tactics often involve a method known as double extortion. In this scenario, attackers do not merely encrypt a company's systems to disrupt operations; they also exfiltrate sensitive data before deploying the ransomware. The goal is to threaten the victim with the public release of this information if the ransom is not paid. By leaking personal details alongside corporate data, attackers increase the psychological and legal pressure on the target organization.

Data involved in the leak

The leak announcement indicates that the compromised information includes both corporate-related data and highly personal details. The specific types of data mentioned in the claim include:

• Employee contact information (specifically including home and mobile phone numbers)

>

The inclusion of personal contact information, such as private mobile and home phone numbers, significantly elevates the risk profile of the incident. When such details are exposed, the individuals involved may become targets for secondary attacks. These include spear-phishing, where attackers use the stolen contact details to craft highly convincing fraudulent messages, or social engineering attacks, where the attacker attempts to manipulate the individual into disclosing further sensitive information or credentials.

About Dorado Software

Dorado Software is a technology company based in the United States that specializes in providing integrated network management, automation, and orchestration software. Their product offerings include Cruz SONiC solutions designed for both enterprise and community networks. The company focuses on developing tools for network performance and edge management, primarily serving organizations that require comprehensive IT infrastructure management, such as rural broadband providers.

Security implications and organizational risks

Given the nature of Dorado Software's business, this incident carries significant implications. Because the company provides network management and automation solutions, a breach of this nature could create secondary risks regarding supply chain security. There is a possibility that client systems could be indirectly impacted if the attackers gain access to tools or credentials used to manage client environments.

Furthermore, because the organization is based in the United States, the exposure of employee data may lead to various legal consequences. This includes potential obligations to comply with state-level data protection laws and mandatory notification requirements for affected individuals. Organizations operating in the technology and infrastructure sectors must remain vigilant against such threats.

To mitigate risks associated with such breaches, organizations typically focus on robust data protection strategies. This includes implementing strict access controls to limit the movement of sensitive data, employing encryption for data at rest and in transit, and conducting regular security audits. Additionally, because of the risk of social engineering following a leak, employee awareness training regarding phishing and identity protection remains a critical component of a modern defensive posture.