Oztugotomotiv listed on Inc Ransom leak site

• Ransomware group: Inc Ransom
• Country: Türkiye
• Sector: Manufacturing
• Announcement date: June 3, 2026

Inc Ransom claims data breach against Oztugotomotiv

The ransomware group known as Inc Ransom has listed the Turkish manufacturing company Oztugotomotiv on its dedicated leak site. According to the group's announcement, which was posted on June 3, 2026, the attackers claim to have successfully exfiltrated 100 GB of data from the organization. This incident, which the group alleges occurred on the same day the announcement was made, appears to be a continuation of the group's established pattern of double-extortion tactics.

Double extortion is a common strategy employed by modern ransomware actors. In this model, attackers do not merely encrypt a victim's systems to disrupt operations; they also steal sensitive information before the encryption phase. The threat actors then use the threat of leaking this stolen data on public forums or specialized leak sites to pressure the victim into paying a ransom. Even if a victim restores their systems from backups, the threat of a public data leak remains a potent tool for the attackers.

Details of the alleged exfiltration

The Inc Ransom group alleges that the breach involves a significant volume of sensitive information. While the group has not specified a ransom demand, they have claimed to have gained access to a wide variety of internal files. These files are said to include confidential documents, client data, non-disclosure agreements (NDAs), financial data, operational records, corporate data, business agreements, and development files.

The specific categories of data mentioned in the listing include:

• Client data
• Financial data
• Non-disclosure agreements
• Corporate documents

The presence of such diverse data types suggests a broad reach into the company's digital environment, potentially impacting various departments from finance to legal and research and development.

About Oztugotomotiv

Oztugotomotiv is an established Turkish company that has been operating since 1990. The organization specializes in the design and production of high-precision components made of plastic, metal, and rubber. These components are intended for critical sectors, including the automotive, defense, and aerospace industries. With a workforce of over 300 employees, the company manages serial production and mold manufacturing facilities located in Bursa and Adapazarı.

Potential impact and security considerations

The claims made by Inc Ransom against Oztugotomotiv could have significant implications for the company's operational continuity and its commercial reputation. The alleged theft of client and financial information may trigger mandatory data breach notification requirements under regulatory frameworks such as the KVKK. Such legal obligations can lead to various legal consequences for the firm if the breach is confirmed.

Furthermore, the public disclosure of such sensitive information can create secondary risks for the company's business partners and its broader supply chain. There is also the risk that the leaked information could be utilized by malicious actors for identity theft or to facilitate highly targeted phishing attacks against employees or clients. Given that Inc Ransom has been active since mid-2023 and utilizes double-extortion methods, it is assessed that the security of the data cannot be guaranteed even if a ransom is paid.

In the manufacturing sector, maintaining the integrity of supply chain data and intellectual property is vital. Organizations in this sector often face risks related to the theft of development files and business agreements. To defend against such threats, companies typically implement multi-layered security strategies. This includes robust access controls, continuous monitoring of network traffic for unusual exfiltration patterns, and comprehensive encryption for data at rest and in transit. Additionally, maintaining a rigorous incident response plan and ensuring regular, offline backups are essential components of a modern cybersecurity posture.