Inc Ransom ransomware group lists latamlex (gyg.local) on its leak site

• Ransomware group: Inc Ransom
• Country: Costa Rica
• Sector: Professional Services
• Announcement date: November 12, 2025

Inc Ransom claims data breach at Latamlex

The threat actor known as Inc Ransom has officially listed the regional law firm Latamlex on its dedicated leak site. According to the announcement made on November 12, 2025, the group claims to have successfully compromised the organization and obtained a significant volume of data belonging to the firm.

This development follows a common pattern in modern cybercrime where ransomware groups use public-facing leak sites to pressure victims. By listing a target, these groups aim to damage the reputation of the victim organization or create public pressure to facilitate their extortion attempts. In this specific instance, the listing suggests that operational data within the firm's regional offices may be at risk due to the alleged compromise.

Details of the alleged data theft

The announcement provided by the Inc Ransom group specifies the scale of the data involved in the incident. The group claims to have exfiltrated a total of 213 GB of data from the organization's systems. While the volume of the data is clearly stated, the leak site entry does not provide specific details regarding the nature of the data contents.

The listing names no specific data types or individual file categories that were allegedly stolen. Consequently, the exact contents of the 213 GB remain unconfirmed and are limited to the volume reported by the threat actor. This lack of granular detail is a frequent occurrence in initial leak site announcements, where the primary goal is to signal the breach rather than provide a full inventory of stolen assets.

About Latamlex

Latamlex is a regional law firm that maintains a significant presence operating in Central America. The firm specializes in several high-stakes legal areas, including arbitration, corporate law, and intellectual property. With a professional team consisting of over 100 attorneys, the firm provides a wide range of legal consulting services. Their client base is diverse, serving both local entrepreneurs and large multinational corporations through their various legal offerings.

Risk assessment and industry implications

As a professional services firm specializing in law, the allegedly compromised data may pose a high risk to client confidentiality and trade secrets. For legal organizations, the protection of sensitive information is a cornerstone of their operations. This incident could potentially lead to legal sanctions under the data protection regulations of the various countries where the firm operates.

The tactics employed by Inc Ransom appear to align with a double-extortion strategy. In such scenarios, attackers do not merely encrypt a victim's systems but also steal sensitive data to use as leverage. By threatening to publish the data, the group attempts to pressure the firm into meeting their demands. Furthermore, there is a possibility that the leaked data could be utilized by third parties for identity theft or targeted phishing attacks, which can further compromise the firm's clients and partners.

The potential negative impacts on the firm's operational continuity and reputation management cannot be overlooked. When organizations in the professional services sector face such threats, they often face significant challenges in maintaining client trust. To mitigate such risks, organizations typically focus on robust defensive measures, such as:

• Implementing strict access controls to limit data exposure.
• Maintaining comprehensive, offline backups to ensure operational continuity.
• Employing continuous monitoring to detect unauthorized data exfiltration.
• Developing comprehensive incident response plans to manage the fallout of a breach.

The incident involving Latamlex highlights the ongoing vulnerability of professional service providers to sophisticated ransomware groups targeting sensitive legal and corporate information.