Inc Ransom ransomware group lists onsolve.com on its leak site

• Ransomware group: Inc Ransom
• Country: United States
• Sector: Technology
• Announcement date: November 22, 2025

Inc Ransom claims data exfiltration from Onsolve

The ransomware group known as Inc Ransom has listed the organization onsolve.com on its dedicated leak site. Through this announcement, the group claims to have successfully exfiltrated data belonging to the organization. This development follows the group's pattern of targeting entities and subsequently publishing their names to exert pressure on the victim.

The announcement was made on November 22, 2025, although the group alleges that the actual compromise of the institution's data occurred earlier, specifically on November 10, 2025. This discrepancy between the date of the attack and the date of the public announcement is a common occurrence in ransomware operations, where attackers often wait to see if their demands are met before going public.

Details of the alleged breach

The claim made by Inc Ransom involves the unauthorized access and theft of information from the target. While the group has published the organization's name on its portal, they have not provided specific details regarding the full scope or the exact nature of the leaked data. The announcement highlights the organization's specific role in critical event management and risk intelligence, suggesting that the stolen information may be related to these specialized functions.

The evidence provided by the threat actor consists of screenshots. These images appear to display various file directories and filenames, which are intended to prove the validity of the breach. However, the group has not disclosed the total volume of data stolen or the specific file count. Furthermore, there is no information available regarding a specific ransom demand or the exact types of data contained within the directories shown in the screenshots. The listing names no specific data types.

About Onsolve

Onsolve is a technology company that specializes in providing critical event management solutions. Their services are designed to help organizations mitigate physical threats and maintain operational agility during various crisis situations. By utilizing AI-powered risk intelligence and advanced critical communication technologies, the company enables both businesses and government agencies to detect, anticipate, and manage potential threats effectively.

Analysis and potential risks

The situation presents several significant risks due to the tactics employed by the threat actor. Inc Ransom is known for using double-extortion tactics, a method where attackers not only encrypt an organization's data but also steal it, threatening to release it publicly unless a ransom is paid. If the alleged data is indeed published, it could pose substantial risks to the organization's operational security and the privacy of its clients.

Because Onsolve provides critical event management technologies, a successful data breach carries implications for supply chain security. Organizations that rely on such critical infrastructure and communication tools may face increased vulnerability if their service providers are compromised. Additionally, as a United States-based entity, the organization may face legal scrutiny under federal regulations and state-level data protection laws following such an incident.

There are also secondary risks to consider, such as the potential for the leaked data to be utilized in identity theft or targeted phishing campaigns. Such campaigns often leverage stolen information to gain further access to networks or to defraud individuals. While Inc Ransom has been an active group since mid-2023, such public listings are typically a strategic move intended to increase pressure on the victim organization to comply with demands.

In general, organizations operating in the technology and critical services sectors often implement defensive measures such as multi-factor authentication, rigorous patch management, and continuous monitoring to mitigate these types of threats. Maintaining robust incident response plans and ensuring data encryption are also standard industry practices to defend against the risks of exfiltration and extortion.