incocommercial.com listed on Safepay leak site

• Ransomware group: Safepay
• Country: United States
• Sector: Professional Services
• Announcement date: November 19, 2024

The threat actor known as Safepay has listed the organization incocommercial.com on its dedicated leak site. According to the group's announcement, the breach involves a significant amount of data claimed to have been exfiltrated from the victim's systems.

The claims made by Safepay

The listing of incocommercial.com was officially announced on the Safepay leak site on November 19, 2024. While the announcement was made in mid-November, the group claims that the actual attack occurred on October 17, 2024. This timeline suggests a period of several weeks between the initial intrusion and the public disclosure on the leak site.

In addition to the claim of data theft, the threat actor included a specific financial note within the listing. The group mentioned the organization's reported revenue of $5 million, a detail often used by ransomware groups to pressure victims during negotiations. This tactic is a common component of modern cyber extortion campaigns.

Details regarding the claimed data

The Safepay group claims to have obtained a total of 210 GB of data from the organization's systems. Despite the substantial size of the reported data, the group has not provided specific details regarding the content of the files. No screenshots or specific file types have been released to verify the nature of the information contained within the 210 GB cache.

The listing names no specific data types or categories of information that were allegedly stolen.

Implications of double extortion

The Safepay group appears to be employing double-extortion tactics. In a double-extortion scenario, attackers do not merely encrypt an organization's data to disrupt operations; they also steal sensitive information before encryption. The threat of leaking this data publicly serves as secondary leverage to compel the victim to pay the ransom, even if the organization has functional backups to restore their systems.

Organization profile

Inco Commercial is a professional services company based in the United States. The company operates in the field of commercial real estate and related business solutions, providing specialized services within the American market.

Risk assessment and industry considerations

Given the nature of the claims, the breach could pose significant risks to the organization. The potential exposure of sensitive information can lead to identity theft or facilitate targeted phishing attacks against both the organization's employees and its customers. Such attacks often leverage the stolen information to appear more legitimate, increasing the success rate of social engineering attempts.

Furthermore, because the organization is based in the United States, the incident may be subject to various state-level data protection laws. This could result in potential regulatory scrutiny and legal obligations regarding data breach notifications. The publication of such data can also negatively impact the commercial reputation of the firm and create concerns regarding security vulnerabilities among its business partners.

For organizations operating in the professional services sector, maintaining robust security postures is critical. Common defensive steps include implementing multi-factor authentication, maintaining offline backups, and conducting regular employee security awareness training to mitigate the risk of phishing. Because public information regarding the Safepay group remains limited, it is currently difficult to make definitive assessments regarding the group's total operational capacity or their future actions following such a listing.