Inc Ransom ransomware group lists www.coopecaja.fi.cr on its leak site

• Ransomware group: Inc Ransom
• Country: Costa Rica
• Sector: Financial Services
• Announcement date: October 15, 2026

Inc Ransom claims a data breach against Coopecaja

The threat actor known as Inc Ransom has listed the Costa Rican organization Coopecaja on its dedicated leak site. This announcement, made on October 15, 2026, involves an allegation of a data breach against the financial services entity. By listing the organization on its portal, the group is signaling its intent to exert pressure through the use of double-extortion tactics.

Double extortion is a common strategy employed by modern ransomware groups. In this method, attackers do not merely encrypt an organization's systems to disrupt operations; they also focus on exfiltrating sensitive information. The threat of leaking this stolen data on a public forum or selling it on the dark web provides the attackers with additional leverage to demand ransom payments from the victim organization.

Details of the alleged event

According to the claim posted by Inc Ransom, the group gained unauthorized access to the systems belonging to Coopecaja. The announcement suggests that the attackers successfully acquired data during their intrusion. The timing of the listing coincides with the claimed date of the attack, which was also October 15, 2026.

Despite the listing on the leak site, the group has not provided specific details regarding the content of the leaked data. There is currently no information available concerning the specific types of files, the total volume of data stolen, or the total number of files involved in the breach. Furthermore, the group has not disclosed a specific ransom demand or any other details regarding the terms of the alleged extortion.

About Coopecaja

Coopecaja is a savings and credit cooperative located in Costa Rica. The organization serves its members by providing a variety of financial products, including various loans and various savings solutions. As a provider of financial services, the organization handles sensitive information related to its members' financial activities and personal details.

Analysis and potential risks

The involvement of Inc Ransom, a group that has been active since mid-2023, highlights the ongoing risks faced by organizations in the financial services sector. Because Coopecaja operates within this sector, the potential exposure of customer information could lead to significant secondary risks. These risks include the possibility of identity theft and various forms of fraud targeting the organization's members.

The use of double-extortion tactics by Inc Ransom means that even if an organization can restore its systems from backups, the threat of data publication or sale remains a critical concern. The exposure of sensitive data can lead to severe consequences, including legal obligations under Costa Rican data protection regulations. The organization may find it necessary to review its internal security processes and may be required to inform the parties affected by the incident.

For organizations operating in the financial sector, maintaining robust security postures is essential to mitigate such risks. Common defensive measures include implementing strict access controls, maintaining regular offline backups, and conducting thorough monitoring of network traffic to detect unauthorized access or data exfiltration attempts. Given the history of the Inc Ransom group, such attacks may also lead to targeted phishing campaigns aimed at the organization or its clients.