Inc Ransom ransomware group lists https://avenira.com/ on its leak site

• Ransomware group: Inc Ransom
• Country: Australia
• Sector: Energy & Utilities
• Announcement date: December 16, 2025

Inc Ransom claims data theft against Avenira Limited

The ransomware group known as Inc Ransom has listed the Australian organization Avenira Limited on its dedicated leak site. According to the group's announcement, they claim to have successfully exfiltrated a significant amount of sensitive information belonging to the company. This claim was published on December 16, 2025, although the group alleges that the actual attack occurred much earlier, specifically on November 17, 2025.

The group's claims suggest a targeted operation aimed at extracting high-value corporate information. While the specific method of entry has not been detailed in the announcement, the presence of the organization on a leak site is a hallmark of modern ransomware operations. These sites serve as a public pressure mechanism, where threat actors post details of their victims to coerce them into meeting ransom demands.

Details of the alleged data exfiltration

Inc Ransom has made specific claims regarding the volume and nature of the data they have allegedly stolen from Avenira Limited. The group asserts that they are in possession of approximately 1 TB of data. This massive volume of information suggests a broad sweep of the organization's digital environment during the period leading up to the alleged breach.

The content of the stolen data is reported to include various types of sensitive documentation. Based on the group's claims and the visual evidence provided in screenshots, the affected data types include:

• Non-disclosure agreements (NDA)
• Corporate data

The inclusion of non-disclosure agreements is particularly significant, as these documents often contain sensitive terms regarding business partnerships, project details, and legal obligations. The group has provided screenshots displaying several document samples to support their claims of possessing this information.

About Avenira Limited

Avenira Limited is an organization based in Australia. The company operates within the mining and exploration sector, focusing on the development of critical mineral projects. Their primary areas of focus include the development and exploration of projects related to phosphate and lithium, which are essential components in various global industrial supply chains.

Analysis and potential implications

The situation involving Avenira Limited highlights the risks associated with double-extortion tactics. In such scenarios, ransomware actors do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive data to use as leverage. By threatening to leak this information publicly or sell it to competitors, the attackers create a secondary layer of pressure on the victim organization.

Given that Avenira Limited is based in Australia, the alleged breach may trigger specific legal obligations. Under the Privacy Act 1988, the organization may face requirements regarding data breach notifications and potential legal sanctions depending on the nature of the compromised information. Furthermore, the exposure of sensitive data belonging to employees or business partners can create a foundation for subsequent malicious activities, such as identity theft or highly targeted phishing attacks.

The Inc Ransom group has been observed to be active since mid-2023 and has demonstrated a pattern of using corporate data as leverage in their operations. For organizations in the energy and utilities or mining sectors, such incidents pose long-term risks to operational continuity and commercial reputation. To mitigate these risks, organizations typically focus on robust data protection strategies, including encryption of sensitive files, strict access controls, and comprehensive monitoring to detect unauthorized data movement. Maintaining a strong incident response plan is also vital for managing the legal and reputational fallout that follows a confirmed data exfiltration event.