Inc Ransom ransomware group lists www.marvimundo.com on its leak site

• Ransomware group: Inc Ransom
• Country: Spain
• Sector: Retail & E-Commerce
• Announcement date: July 15, 2025

Inc Ransom claims data breach at Marvimundo

The Spanish retail company Marvimundo has been listed on the leak site of the ransomware group known as Inc Ransom. According to an announcement made by the threat actors on July 15, 2025, the group claims to have successfully exfiltrated data belonging to the organization. The group asserts that the initial access or the data acquisition occurred in early May 2025.

To support their claims of a successful breach, the threat actors provided evidence in the form of screenshots. These images allegedly contain various file directories and images of identification cards, which the group presents as proof of their access to the organization's internal environment.

Details of the alleged data exfiltration

The content of the shared screenshots suggests a significant breach of sensitive information. The files identified by the group include various database files, specifically in .ndf and .mdf formats, which are commonly associated with SQL Server databases. Furthermore, the leaked material reportedly includes corporate reports and financial statements that provide insight into the company's operations.

In addition to corporate and financial documentation, the group claims to have obtained sensitive personal information. The specific types of data identified in the leak include:

• Personal identification information
• Financial data
• Corporate reports
• Database files

The presence of personal identification cards in the screenshots highlights the potential exposure of sensitive individual data.

About Marvimundo

Marvimundo is a Spain-based perfumery and cosmetics retailer. The company operates within the retail and e-commerce sector, offering a wide range of beauty, personal care, and fragrance products. Their business model utilizes both physical stores and an e-commerce platform to reach their customer base.

Impact and security implications

This alleged breach poses significant risks to the organization, particularly regarding identity theft and fraud targeting the company's employees and customers. Because the organization operates within Spain, it is subject to the General Data Protection Regulation (GDPR). Consequently, the company may face legal obligations and potential administrative sanctions concerning the protection of personal data under these regulations.

Inc Ransom is a ransomware group that emerged in mid-2023. The group is known for employing double-extortion tactics. In a double-extortion scenario, attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage. They threaten to leak the stolen data on public forums if a ransom is not paid, thereby increasing the pressure on the victim. Given this tactic, the leaked data could potentially be used for targeted phishing attacks in the future.

The disclosure of financial and operational data may also lead to a loss of commercial reputation and could weaken the security of the organization's supply chain. For organizations in the retail and e-commerce sectors, such incidents underscore the importance of robust data protection strategies. Common defensive steps for organizations include implementing multi-factor authentication, maintaining regular offline backups, conducting regular security audits, and ensuring strict access controls to sensitive databases and personal information.