Larc listed on Inc Ransom leak site

• Ransomware group: Inc Ransom
• Country: United States
• Sector: Professional Services
• Announcement date: August 22, 2024

The professional services organization Larc has been listed on the leak site of the ransomware group known as Inc Ransom. According to the announcement made by the threat actors, the organization has been targeted in a cyberattack, marking a new addition to the group's public list of victims.

The claimed attack event

The Inc Ransom group officially added Larc to its leak platform on August 22, 2024. While the announcement was made in late August, the threat actors claim to have successfully gained access to the organization's internal systems much earlier, specifically on July 24, 2024. This discrepancy between the initial access and the public listing is a common occurrence in ransomware operations, where attackers may spend time navigating networks before making a public announcement.

The listing serves as a public notification from the ransomware group, though the specific details regarding the method of entry or the duration of the unauthorized access remain undisclosed by the attackers. At this stage, the information is based solely on the claims made by the Inc Ransom group on their designated leak site.

Information regarding the leaked data

Despite the listing, the announcement page provides very little detail regarding the specific content of the alleged breach. There is no information provided regarding the nature of the leaked or compromised data. Furthermore, the screenshot associated with the announcement does not contain any images or lists detailing the content of the data.

The listing names no specific data types or file categories that have been targeted or stolen. There is no information available regarding the total size of the data, the number of files involved, or any specific ransom demands made by the group in relation to this particular target.

About Larc

Larc is a workshop that provides job skills training to individuals and performs subcontracted work such as sorting, packaging, labeling, and assembly for various companies. The organization aims to provide employment opportunities for individuals with disabilities or disadvantages, helping them gain a sense of achievement.

Analysis and potential implications

Given the double-extortion tactics frequently employed by the Inc Ransom group, there is a possibility that the organization's sensitive data may have been exfiltrated. Double extortion is a method where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release, thereby increasing the pressure to pay a ransom.

This situation could lead to the exposure of personal information belonging to employees or client companies. Because Larc provides subcontracted services and training, the data involved could potentially include sensitive records related to its workforce or its business partners. As the organization is based in the United States, a potential data breach may result in legal consequences under state-level privacy laws and sectoral regulations.

In such scenarios, organizations may need to inform their employees and business partners about potential secondary attack risks and implement necessary security measures. The risk of secondary attacks, such as phishing or social engineering, often increases after a data breach occurs. It is important to note that public information regarding the Inc Ransom group remains limited, making it difficult to determine the full scope of their operational patterns.

• Potential exposure of sensitive employee information
• Potential exposure of client company data
• Legal implications under US state-level privacy laws