Inc Ransom ransomware group lists proton-system_Serbia on its leak site

• Ransomware group: Inc Ransom
• Country: Serbia
• Sector: Technology
• Announcement date: January 3, 2026

The Inc Ransom group has officially listed the Serbian-based organization Proton System on its dedicated leak site. According to the claims made by the threat actors, the group has exfiltrated a significant amount of data and is threatening to release it to the public if their demands are not met.

The claims made by Inc Ransom

The incident involves a direct threat from the Inc Ransom group, which has announced its intention to publish data belonging to Proton System. According to the group's announcement, they attempted to establish contact with the management of the organization to initiate negotiations. However, the threat actors claim that their attempts to communicate were ignored by the company's leadership.

As a consequence of this alleged lack of communication, the group has stated that they will proceed with publishing the stolen information. The group has explicitly mentioned that if negotiations do not continue, more than 130 GB of data will be made public on their leak site. This follows a pattern often seen in modern ransomware operations, where the threat actor uses the threat of data exposure as a primary lever to pressure the victim into compliance.

Data involved in the alleged breach

While the full extent of the stolen information is not yet known, the group has provided some evidence to support their claims. The post includes screenshots that allegedly show small-scale samples of internal file directories and various financial documents. These samples are intended to demonstrate that the group has gained access to the organization's internal systems.

The group asserts that the alleged leak contains sensitive information. Based on the provided details, the following types of data are identified as being affected:

• Personal data

It is important to note that while the group claims a total data volume of over 130 GB, the specific file count and the exact ransom demand have not been disclosed in the announcement.

About Proton System

Proton System is an organization based in Serbia that has been in operation since 1999. The company specializes in the distribution, logistics, and marketing of a wide range of products, including pharmaceuticals, medical devices, and dietary products. Their business operations span across several major regions, including Europe, the Middle East, and North Africa. The company's core focus is centered on the representation and evaluation of products that are dedicated to family health.

Analysis and organizational implications

The alleged leak of data from an organization like Proton System carries significant secondary risks. For the employees and customers of the company, the exposure of personal information can lead to serious consequences, such as identity theft and the execution of highly targeted phishing attacks. When personal data is exfiltrated, it becomes a tool for further social engineering campaigns against the individuals involved.

Furthermore, because Proton System operates within Serbia, this potential leak could trigger various legal processes under local data protection regulations. Organizations operating in highly regulated sectors must be prepared for the legal and compliance ramifications that follow a data breach. The disclosure of sensitive information often necessitates formal reporting to regulatory authorities and can lead to significant scrutiny.

The tactics employed by Inc Ransom are characteristic of double-extortion ransomware. In this model, attackers do not just encrypt files to disrupt operations; they also steal sensitive data to use as leverage. Even in scenarios where a ransom is paid, the security of the exfiltrated data cannot be guaranteed, as the threat actors may still choose to leak it or sell it on other forums.

For organizations in the technology and distribution sectors, maintaining robust security postures is essential. This includes implementing strict access controls, monitoring for unauthorized data exfiltration, and ensuring that all communication channels are secured. Protecting the integrity of internal file directories and financial documentation is a critical component of defending against such sophisticated threats.