Iscamen listed on Inc Ransom leak site

• Ransomware group: Inc Ransom
• Country: Argentina
• Sector: Agriculture and Food Production
• Announcement date: June 5, 2025

Inc Ransom claims data breach at iscamen

The Inc Ransom ransomware group has listed the Argentina-based agricultural organization iscamen on its leak site, claiming to have published the entity's data. This announcement, which appeared on June 5, 2025, marks a new development in the group's ongoing activities targeting various sectors.

According to the group's claims, they have successfully compromised the organization's data and are threatening to release this information publicly. The announcement on the leak platform includes a description of the organization's activities, providing context to the target of the alleged attack. This type of public listing is a common tactic used by ransomware groups to exert pressure on their victims.

Details regarding the claimed data

While the group has made a public claim regarding the breach, specific details regarding the content of the leaked data have not been provided. The group has not specified the volume of the data or the exact number of files involved. However, the group claims to have shared a dataset that is labeled as 'iscamen_full'.

The listing does not name any specific data types that have been compromised. This lack of detail is common in the early stages of a leak-site announcement, where groups often use vague labels to build tension before revealing more information or as part of their extortion process.

About iscamen

ISCAMEN is an official agricultural agency located in the Mendoza province of Argentina. The organization plays a critical role in the region's agricultural sector by regulating the entry of agricultural products and protecting plant health. Furthermore, the agency manages pest control and conducts technical programs focused on agricultural waste management and the protection of local agriculture.

Risk assessment and implications

Given the double-extortion tactics employed by the Inc Ransom group, there is a possibility that the organization's sensitive operational and administrative data may have been exposed. Double extortion is a method where threat actors not only encrypt an organization's data but also steal it, threatening to leak the sensitive information if a ransom is not paid. This approach significantly increases the pressure on the victim, as the threat of data exposure can cause lasting reputational and legal damage.

This incident could potentially undermine the organization's credibility regarding its agricultural oversight and phytosanitary programs. Furthermore, there is an assessment that the leaked data could pose secondary risks to supply chain partners and local producers who rely on the agency's regulatory functions. The entity may also face legal obligations under Argentine data protection regulations following such a potential exposure.

The Inc Ransom group is a threat actor that has been active since mid-2023 and employs similar methods in their campaigns. To defend against such threats, organizations in the agricultural and food production sector can implement various defensive steps. These include maintaining robust backup solutions, implementing strict access controls, and ensuring regular security training for staff to recognize phishing attempts. Strengthening network monitoring and maintaining a comprehensive incident response plan are also essential components of a modern cybersecurity posture to mitigate the impact of ransomware and data exfiltration attempts.