Inc Ransom ransomware group lists https://daricon.com/ on its leak site

• Ransomware group: Inc Ransom
• Country: United States
• Sector: Financial Services
• Announcement date: February 26, 2026

Inc Ransom claims a major breach at Daricon

The threat actor known as Inc Ransom has listed data allegedly belonging to daricon.com on its leak site. In an announcement published on February 26, 2026, the group claims to have gained access to the organization's systems. The group asserts that the breach involves a significant volume of information, with the alleged data amounting to 400 GB.

Ransomware leak sites are platforms used by cybercriminal groups to pressure victims into paying ransoms. These groups often employ a double-extortion strategy, where they not only encrypt an organization's internal systems but also steal sensitive data. If the ransom is not paid, the attackers threaten to release the stolen information publicly to cause maximum reputational and operational damage. This method significantly increases the pressure on the victim, as the threat of a public leak can lead to severe legal, regulatory, and reputational consequences.

Details of the alleged data theft

The content of the alleged leak is highly sensitive, spanning various sectors including military and international diplomacy. According to the claims made by Inc Ransom, the stolen data includes correspondence with NATO and US Army employees, as well as confidential documents and signatures of NATO generals. Furthermore, the group claims to possess passport addresses, shipment details, photos, videos, technical drawings, employee emails, phone numbers, and contracts with the Canadian and US armies.

The breach also reportedly involves documentation regarding oil-related projects in Iraq, Uganda, and other locations. The specific types of affected data mentioned in the claim include:

• Employee personal data
• Email correspondence
• Passport information
• Contracts
• Military correspondence

The presence of such diverse and sensitive information types suggests a broad compromise of the organization's digital environment, potentially affecting multiple departments and external partners.

About Daricon

Daricon is a financial consulting and investment services firm based in Houston, Texas. The company specializes in providing financial strategies and operational support for international energy projects, with a primary focus on the energy and oil sectors.

Risk assessment and implications

Given that the Inc Ransom group employs a double-extortion strategy, this situation may pose significant data privacy risks for the organization. The military and diplomatic nature of the allegedly leaked data could trigger secondary risks concerning corporate reputation as well as national security processes. Because the organization is based in the US, legal proceedings may be required under relevant state laws and federal regulations.

The sensitivity of the alleged data may increase the likelihood of employees and third-party stakeholders being subjected to targeted phishing attacks. In such scenarios, attackers often use stolen personal details to craft highly convincing messages designed to trick individuals into revealing further credentials or installing malware.

While the Inc Ransom group has been active since 2023, such leaks can create profound operational and legal impacts on an organization. For companies operating in the financial and energy sectors, maintaining robust cybersecurity frameworks is essential. Organizations in these sectors often implement defensive measures such as multi-factor authentication, network segmentation, and continuous monitoring to mitigate the risk of unauthorized access. Additionally, rigorous data encryption and regular security audits are standard practices used to protect sensitive intellectual property and personal information from evolving threat landscapes.