Inc Ransom ransomware group lists rxm.com.au on its leak site

• Ransomware group: Inc Ransom
• Country: Australia
• Sector: Healthcare
• Announcement date: April 8, 2026

The Inc Ransom ransomware group has listed the Australian pharmacy network rxm.com.au on its dedicated leak site. According to the announcement made on April 8, 2026, the threat actor group claims to have successfully carried out a data breach against the organization, which allegedly occurred on March 19, 2026.

The alleged incident involving rxm.com.au

The Inc Ransom group has published information they claim belongs to rxm.com.au on their leak site. The listing provides specific details regarding the organization's operations, which include community pharmacy services and solutions for health, beauty, and lifestyle needs. The group alleges that they have exfiltrated a significant volume of information, claiming the total size of the stolen data is approximately 184.66 GB.

Ransomware groups often utilize leak sites to pressure victims into paying ransoms. This process typically involves a transition from the initial encryption of systems to the exfiltration of sensitive data. When a group uses a leak site to host stolen files, it is often part of a broader strategy designed to maximize the pressure on the victim organization by threatening to release the information to the public or to competitors.

Potential data exposure

While the full extent of the breach is still being assessed based on the group's claims, the presence of specific icons in the screenshots provided by the attackers suggests that various types of sensitive information may have been compromised. The listing indicates that the following categories of data may be involved:

• Financial data
• Personal data
• Corporate documents

The exposure of such data types can lead to significant complications for an organization. For instance, the theft of corporate documents can reveal internal strategies, while the loss of personal and financial data can lead to direct harm to individuals. In many cases, these groups employ double-extortion tactics, where they not only encrypt the victim's systems but also threaten to leak the stolen data if the ransom is not met. This approach increases the pressure on the victim, as the threat of public exposure remains even if the organization can restore its systems from backups.

About Rx Management

Rx Management is a pharmacy franchise network that maintains a significant presence across Australia. The organization operates within the New South Wales, Victoria, and South Australia regions. They specialize in providing community pharmacy services, offering a range of solutions that encompass health, beauty, and lifestyle products to their customer base.

Risks and industry implications

Given the double-extortion tactics employed by the Inc Ransom group, there is a persistent risk that the exfiltrated data could be made public or sold on illicit forums. Because the organization operates within the healthcare sector, this breach may pose specific risks under Australian data protection regulations regarding the privacy of patient information. The exposure of employee and customer data could potentially facilitate identity theft and targeted phishing attacks against the individuals involved.

The group known as Inc Ransom has been active since mid-2023, and such leaks can have a profound impact on an organization's reputation and its ability to maintain operational continuity. Beyond the immediate impact on the pharmacy network, secondary risks may include the possibility of supply chain attacks and the disclosure of sensitive corporate information that could affect business partners.

For organizations operating in the healthcare and pharmacy sectors, maintaining robust cybersecurity postures is critical. This includes implementing strict access controls, continuous monitoring of network traffic, and ensuring that data encryption is applied both at rest and in transit. Furthermore, organizations must be prepared for the regulatory implications of data breaches, particularly when sensitive patient or personal information is involved, to ensure compliance with regional privacy laws and to mitigate the impact on their community.