Inc Ransom ransomware group lists GDN AR(Dorinka) on its leak site

• Ransomware group: Inc Ransom
• Country: Argentina
• Announcement date: June 29, 2026

Inc Ransom claims data breach at Dorinka S.R.L.

The threat actor known as Inc Ransom has listed the Argentina-based grocery chain Dorinka S.R.L. on its leak site, alleging a data breach. The announcement, which appeared on June 29, 2026, marks a new targeting of the retail sector by the group. While the group claims to have compromised the organization's data, the specific details regarding the extent of the intrusion remain unverified.

According to the announcement made by the group, the threat actor claims to have successfully compromised the organization's data and has issued threats to release this information publicly. The listing includes general details regarding the organization's operations and employee count, though specific metrics for these categories were not provided in the announcement.

Details of the alleged data compromise

The exact nature of the compromised data has not been specified by the threat actor. While the group's leak site announcement includes screenshots containing blurred document samples, the specific content and the volume of the information remain unknown. The listing does not specify the total number of files or the total size of the data allegedly stolen during the incident.

The listing names no specific data types that have been compromised.

Implications of double-extortion tactics

Given that the Inc Ransom group is known to employ double-extortion tactics, the organization may face significant challenges. Double extortion is a common ransomware strategy where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage. The threat of leaking stolen data serves as a secondary pressure tactic to compel victims into paying a ransom, regardless of whether the organization can restore its systems from backups.

About Dorinka S.R.L.

Dorinka S.R.L. is an Argentina-based retail company operating primarily in the grocery store industry. The company is headquartered in Buenos Aires and serves as a significant entity within its regional market.

Potential risks and organizational impact

The alleged breach presents several risks to the organization and its stakeholders. If employee and customer data have been compromised, individuals may face risks of identity theft and targeted phishing attacks. Furthermore, the organization could face legal sanctions under data protection regulations in Argentina. The group's past activities suggest that the release of data may trigger secondary attacks, as threat actors often use leaked information to facilitate further exploitation or social engineering campaigns.

The impact of such an incident may extend beyond the immediate organization. The organization's supply chain partners may also be indirectly affected by this situation, as interconnected business processes can create pathways for cascading disruptions. When a retail entity faces operational disruptions, the flow of goods and services to partners and vendors can be hindered.

To mitigate the risks associated with such threats, organizations typically focus on robust defensive measures. These include maintaining rigorous patch management to close vulnerabilities, implementing multi-factor authentication across all access points, and conducting regular security awareness training for employees to recognize phishing attempts. Additionally, maintaining offline, immutable backups is a critical component of a resilient defense strategy to counter the encryption phase of ransomware attacks.