Inc Ransom ransomware group lists https://daricon.com/ (military US/CA/NATO) on its leak site

• Ransomware group: Inc Ransom
• Country: United States
• Sector: Government & Defense
• Announcement date: February 26, 2026

Inc Ransom claims to have stolen 400 GB of data from Daricon

The ransomware group known as Inc Ransom has published an announcement on its leak site claiming to possess a significant amount of data allegedly belonging to Daricon. According to the group's claim, the breach occurred on February 25, 2026, and was officially announced on their platform on February 26, 2026. The threat actor asserts that they have successfully exfiltrated 400 GB of data from the organization's networks.

The group's announcement alleges that the stolen information includes highly sensitive correspondence involving personnel from NATO and the US Army. This claim suggests that the breach may extend beyond simple corporate data to include information that impacts international military communications and confidential documentation.

Details of the alleged data exfiltration

The content of the alleged leak is extensive and covers various sensitive categories. The threat actor claims that the data includes signatures of NATO generals, passport addresses, and the personal data and email addresses of employees. Furthermore, the group asserts that the stolen information contains shipment details, technical drawings, photos, videos, and contracts involving both the Canadian and US Army.

In addition to military-related documentation, the group reports that the data includes documentation regarding oil-related operations in various locations, specifically mentioning Iraq and Uganda. The specific types of data allegedly compromised include:

• Employee personal data
• Email addresses
• Passport information
• Contracts
• Military correspondence
• Technical drawings

About Daricon

Daricon is a technology company that manufactures precision components, electronic systems, and custom engineering solutions for the defense and aerospace industry. Based in the United States, the firm provides high-performance hardware for military and industrial applications.

Security implications and industry context

This alleged breach may pose a significant security risk due to the sensitive nature of military and defense-related information. The exposure of employee personal data could lead to secondary risks such as targeted phishing and identity theft. The reported connections to NATO and the US Army may raise concerns regarding international security protocols and supply chain integrity. As the entity is based in the US, this incident may trigger legal scrutiny under relevant data protection regulations and defense industry compliance standards.

The tactics employed by Inc Ransom, which involve the public release of sensitive information, suggest an intent to exert pressure on the organization through double-extortion. In such scenarios, ransomware actors do not just encrypt systems but also steal data to threaten the victim with public exposure. This method is designed to maximize the pressure on an organization to meet ransom demands.

For organizations operating within the defense and aerospace sectors, maintaining robust security protocols is critical to protecting sensitive technical drawings and military contracts. Protecting the supply chain is a primary concern when contractors handle data related to international entities like NATO or national militaries. Standard defensive measures for organizations in this sector typically involve implementing strict access controls, monitoring network traffic for unusual exfiltration patterns, and ensuring comprehensive encryption for both data at rest and data in transit. Furthermore, managing the risks associated with third-party contractors and ensuring compliance with defense industry standards remains a vital component of a modern cybersecurity posture.