Inc Ransom ransomware group lists pharma5.ma on its leak site

• Ransomware group: Inc Ransom
• Country: Morocco
• Sector: Healthcare
• Announcement date: September 25, 2026

The Morocco-based healthcare organization pharma5.ma has been listed on the Inc Ransom leak site. The ransomware group claims to have successfully exfiltrated a significant volume of data from the company, alleging the breach occurred on September 25, 2026.

The alleged incident and claims by Inc Ransom

According to the announcement made by the Inc Ransom ransomware group, the organization was targeted in a cyberattack. The group claims that the incident, which they date to September 25, 2026, involved the theft of sensitive information. While the group has published a listing on their leak site, they have not provided information regarding a ransom demand.

The total volume of the data claimed to have been exfiltrated by the group is stated to be 50 GB. The group's involvement in such activities is consistent with their known operational patterns, as the group is known to have emerged in mid-2023. The publication of this data on a leak site is a common tactic used by ransomware actors to exert pressure on their targets.

Details of the claimed stolen data

The Inc Ransom group alleges that the breach resulted in the theft of various types of sensitive information. The data reportedly includes corporate and financial details, as well as information related to the company's operations and personnel. The specific categories of data claimed to be involved in the leak include:

• Corporate data
• Financial data
• Supply chain data
• Quality control records
• Employee personal data
• Counterparty information

The group further claims that the stolen information encompasses data on products and their supply, quality control and certification, drug testing and related issues, and employee personal data, alongside counterparty information.

About pharma5.ma

Pharma5 is a Morocco-based pharmaceutical company engaged in the manufacturing and development of medicines. The organization produces generic drugs across various therapeutic areas.

Potential impact and industry implications

The alleged data leak may negatively impact the organization's operational continuity and commercial reputation. Because the organization operates in the healthcare sector, the sensitivity of the leaked data may create challenges regarding regulatory compliance. The exposure of personal data belonging to employees and business partners could lead to secondary risks such as identity theft and targeted phishing attacks.

This incident highlights the risks associated with double-extortion tactics, a method where ransomware groups not only encrypt an organization's systems but also steal sensitive data to threaten its public release. In such scenarios, the publication of data is often intended to increase leverage over the victim. For organizations in the healthcare and pharmaceutical sectors, such breaches necessitate a rigorous re-evaluation of cybersecurity measures and data protection strategies to mitigate the risks of operational disruption and the exposure of highly sensitive corporate and personal information.