Inc Ransom ransomware group lists TBTEAM on its leak site

• Ransomware group: Inc Ransom
• Country: United States
• Sector: Professional Services
• Announcement date: November 22, 2025

The Inc Ransom ransomware group has officially listed the United States-based company OnSolve on its leak site. Through this announcement, the threat actor group claims to have successfully breached the organization and gained access to sensitive information. This development follows a pattern of activity observed with ransomware groups that utilize public leak sites to pressure victims by threatening the release of stolen data.

The claims made by Inc Ransom

According to the announcement posted on November 22, 2025, the Inc Ransom group alleges that it has gained unauthorized access to the critical event management and risk intelligence data belonging to OnSolve. The group has not provided specific details regarding the exact nature of the breach or the methods used to infiltrate the network.

As part of their public announcement, the group has released visual samples intended to demonstrate the validity of their claim. These samples include screenshots that purportedly show the company's internal file directories and technical configurations. By publishing these images, the group attempts to prove they have successfully navigated the victim's internal systems and have access to operational data.

Details regarding the leaked data

While the group has provided visual evidence of file structures and configurations, the announcement lacks a comprehensive breakdown of the stolen information. There is no detailed information provided regarding the full scope of the breach, the specific content of the files, or the total volume of data involved. Furthermore, the group has not disclosed the total file count or the specific size of the data exfiltrated from the organization.

The listing names no specific data types within a structured list, leaving the full extent of the compromise unknown at this time.

Organization profile: OnSolve

OnSolve is a technology company that operates within the professional services sector. The company specializes in providing critical event management solutions designed to mitigate physical threats and ensure organizational agility during various crises. By utilizing AI-powered risk intelligence and advanced critical communication technologies, OnSolve provides essential security management services to a wide range of clients, including large enterprises and various government institutions.

Implications and security considerations

The alleged breach of OnSolve carries significant implications due to the nature of the services the company provides. Because OnSolve is responsible for critical event management and risk intelligence, this situation may pose operational risks for its various clients and stakeholders who rely on these systems for crisis management and security. Furthermore, the incident could potentially have negative implications for broader supply chain security, given the company's role in supporting enterprise and government infrastructure.

The Inc Ransom group is known to employ double-extortion tactics. In these types of attacks, threat actors not only encrypt an organization's data to disrupt operations but also steal sensitive information beforehand. This stolen data is then used as leverage, where the group threatens to leak it publicly unless a ransom is paid. This secondary layer of extortion increases the pressure on the victim, as the threat of data exposure can lead to reputational damage, regulatory scrutiny, and identity theft.

As a United States-based entity, any confirmed data breach involving OnSolve may trigger complex legal processes. Such processes are governed by various state-level privacy laws and federal regulations designed to protect consumer and organizational data. Organizations operating in the professional services and critical infrastructure sectors often face heightened scrutiny following such incidents.

To defend against such threats, organizations typically focus on robust security postures. This includes implementing multi-factor authentication, maintaining strict network segmentation to prevent lateral movement, and ensuring comprehensive logging and monitoring to detect unauthorized access early. Additionally, maintaining offline, immutable backups is a standard defensive measure to mitigate the impact of encryption-based ransomware.