INC Ransom ransomware group lists silocaf.com on its leak site

• Ransomware group: INC Ransom
• Country: United States
• Sector: Manufacturing
• Announcement date: April 9, 2025

INC Ransom claims Silocaf has been compromised

The INC Ransom group has officially listed the United States-based manufacturing company Silocaf on its dedicated leak site. According to the announcement made by the threat actors, the group claims to have gained unauthorized access to the organization's systems, leading to a significant data breach. This listing was publicly announced on April 9, 2025, marking a new development in the group's ongoing activities against various targets.

The claims made by INC Ransom suggest that the breach may have occurred as early as February 28, 2025. In their announcement, the group has attempted to validate their claims by publishing specific details related to the company, including its contact information and various operational details. This practice is a common tactic used by ransomware groups to demonstrate the legitimacy of their intrusion to both the victim and the public.

Details regarding the alleged data theft

The scale of the alleged data exfiltration is substantial. The INC Ransom group claims that approximately 178 GB of data belonging to Silocaf has been compromised. While the specific file count was not provided in the announcement, the group has shared certain evidence to support their claims of a successful breach.

The available information regarding the content of the stolen data is limited to the following:

• The group has provided screenshots that include three document previews, which appear to be related to corporate files.

No specific list of individual data types or categories was provided in the announcement, though the volume of data suggests a wide-reaching impact on the company's digital environment.

About Silocaf

Silocaf of New Orleans is a manufacturing company that specializes in the processing and blending of coffee. Established in 1993, the firm has a long-standing presence in the industry. The company operates as a subsidiary of the Italian firm Pacorini S.r.l.

Potential risks and industry implications

The alleged leak poses significant risks to the organization's operational continuity and its commercial reputation. Depending on the actual nature of the 178 GB of data claimed by the attackers, there is a possibility that sensitive information, such as employee personal information or trade secrets, could be exposed to unauthorized parties.

Because Silocaf is a US-based entity, the company may face various legal obligations. This includes potential data breach notification requirements mandated by relevant state laws and federal regulations. The situation highlights the complex regulatory landscape that manufacturing firms must navigate following a cyber incident.

The threat posed by INC Ransom is particularly notable due to their known use of double-extortion tactics. In a double-extortion scenario, attackers not only encrypt a victim's data to disrupt operations but also steal sensitive information to use as leverage. They threaten to leak this data on public sites if the ransom is not paid, thereby increasing the pressure on the organization. Such tactics can lead to secondary attacks, such as targeted phishing attempts against the company or its partners, using the stolen information to gain further access or conduct fraud.

For organizations operating within the manufacturing sector, these types of incidents underscore the importance of robust cybersecurity frameworks. Common defensive steps for organizations include implementing strict access controls, maintaining offline backups, and conducting regular security audits to identify vulnerabilities before they can be exploited by threat actors.