Inc Ransom ransomware group lists www.enea.com on its leak site

• Ransomware group: Inc Ransom
• Country: Sweden
• Sector: Technology
• Announcement date: December 1, 2025

Inc Ransom claims data breach at Enea

The threat actor group known as Inc Ransom has listed the Swedish technology company Enea on its dedicated leak site. According to the announcement made on December 1, 2025, the group claims to have successfully compromised and obtained a significant volume of data belonging to the organization.

The incident was officially announced by the threat actors on the same day they claimed the attack took place. While the listing serves as a public claim by the ransomware group, the specific details regarding the breach remain centered on the volume of information the group asserts they have stolen from the victim.

Details of the claimed attack

The claim made by Inc Ransom involves a substantial amount of information. The group asserts that they have exfiltrated 79 GB of data from Enea. Although the group has provided a specific size for the stolen data, the provided information does not specify the exact nature or the specific types of files that were compromised during the incident.

The announcement also included an estimate regarding the annual revenue of the organization, though the specific figures for this estimate were not detailed in the claim. Regarding the contents of the breach, the listing names no specific data types.

About Enea

Enea is a Swedish technology company that specializes in providing software solutions for telecommunications networks and cybersecurity. The company's operations are global, serving various operators and equipment manufacturers. Their expertise lies in several critical technical fields, including network management, traffic analysis, and the development of embedded systems.

Analysis and potential implications

Inc Ransom is a threat actor group that emerged in mid-2023. The group is recognized for employing double-extortion tactics. In a double-extortion scenario, attackers do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive data to use as leverage. By threatening to leak the stolen information on public platforms, the attackers aim to pressure the victim into paying a ransom to prevent the disclosure of sensitive corporate or personal information.

Because the group's modus operandi involves the threat of data publication, the organization's operational continuity may be at risk beyond the initial digital intrusion. Furthermore, since Enea is based in Sweden, this incident may fall under the scope of the General Data Protection Regulation (GDPR). This regulatory framework often necessitates specific data breach notification requirements to ensure that authorities and affected individuals are informed of potential compromises.

The potential publication of stolen data can lead to various secondary risks for both employees and customers. These risks include the possibility of identity theft or the execution of highly targeted phishing campaigns using the leaked information to gain further access or conduct fraudulent activities.

For organizations operating in the technology and telecommunications sectors, maintaining a robust security posture is essential. General defensive measures often include regular security reviews, verifying the validity of claims made by threat actors, and implementing strict monitoring to detect unauthorized data exfiltration. Given the known tactics of groups like Inc Ransom, organizations must be prepared to manage both the technical recovery of systems and the legal and reputational complexities arising from data exposure.