Inc Ransom ransomware group lists pyasolutions.com on its leak site

• Ransomware group: Inc Ransom
• Country: Canada
• Sector: Technology
• Announcement date: February 18, 2025

Inc Ransom claims data breach against PYA Solutions

The Inc Ransom threat actor group has listed approximately 243 GB of data on its leak site, which the group alleges belongs to the technology firm PYA Solutions. According to the announcement made on February 18, 2025, the group claims to have targeted the organization in a ransomware attack that allegedly occurred on January 30, 2025.

Details of the alleged attack

The Inc Ransom group claims to have conducted a ransomware attack against PYA Solutions, subsequently listing the organization on its leak site. Through this announcement, the threat actor alleges that it has successfully obtained 27,962 files from the company's internal systems. By targeting the organization's operational data, the threat actor appears to be employing a double-extortion strategy to exert pressure on the victim.

Double extortion is a common tactic used by modern ransomware groups. In this method, attackers do not merely encrypt a victim's data to disrupt operations; they also exfiltrate sensitive information before the encryption process begins. The attackers then threaten to leak this stolen data on public forums or specialized leak sites if the ransom is not paid. This approach creates significant leverage for the criminals, as the threat of public exposure can cause immense reputational and regulatory damage, even if the organization has robust backups to recover from the initial encryption.

The screenshots provided in the announcement display various business documents, contracts, and file directory structures; however, there is no detailed inventory regarding the full scope of the leaked data. While the volume of the data is significant, the specific contents remain largely unverified through the provided evidence.

Affected data types

Based on the information provided in the leak site announcement, the following types of data are identified as being involved in the breach:

• Business documents
• Contracts

About PYA Solutions

PYA Solutions is a technology company specializing in Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central. It aims to improve business efficiency by providing tailored ERP solutions to businesses in various sectors, including leasing, wholesale, and distribution.

Impact and industry implications

The reported breach may pose significant risks to PYA Solutions' business operations and client data. Given that the organization is based in Canada, the incident may trigger data privacy obligations under the Personal Information Protection and Electronic Documents Act (PIPEDA). As the company provides ERP solutions, there is a possibility that the leaked data includes sensitive business processes or financial information belonging to its clients.

Inc Ransom's double-extortion tactic suggests that the leak could lead to secondary risks, such as targeted phishing or identity theft for both the organization and its clients. Furthermore, the company's position in the technology sector may introduce risks regarding supply chain security. When a technology provider that manages critical business processes like ERP is compromised, it can create a ripple effect that impacts the security posture of its entire client base.

For organizations operating within the technology and ERP service sectors, maintaining rigorous security standards is essential to mitigate these risks. Common defensive steps include implementing multi-factor authentication (MFA) across all systems, maintaining offline and immutable backups, and conducting regular vulnerability assessments. Additionally, organizations should focus on robust data loss prevention (DLP) strategies and continuous monitoring to detect unauthorized exfiltration attempts early in the attack lifecycle. Strengthening supply chain security through strict third-party risk management is also a critical component for technology firms to protect their clients' sensitive operational and financial data.