Repechage claims data breach by incransom

• Ransomware group: incransom
• Country: United States
• Sector: Retail & E-Commerce
• Announcement date: November 3, 2025

The incransom group claims a massive data breach at Repechage

The incransom ransomware group has announced that it has compromised data belonging to Repechage, a company operating in the United States. According to an announcement made on a leak site on November 3, 2025, the threat actor group alleges that they have successfully exfiltrated a significant volume of sensitive information from the organization.

The claim involves a substantial amount of data, with the group alleging that they are in possession of 1 TB of personal information. The group has stated that their attempts at reaching a resolution with the organization have been ignored. As a result of this lack of response, the group has threatened to publish the stolen data online. It is important to note that while the group has made these claims, no screenshot has been provided to verify the contents of the alleged breach.

Details of the alleged data theft

The information allegedly stolen by the incransom group is said to be highly sensitive, covering various aspects of the organization's internal and external operations. The group claims to possess a wide array of data types that could impact multiple stakeholders. According to the announcement, the affected data includes:

• Employee contact information
• Employee job titles
• Medical records
• Client data
• Partner data

The presence of such diverse data sets, ranging from professional identifiers to highly sensitive medical information, highlights the potential scale of the compromise. The group has not disclosed a specific ransom demand in their announcement.

About Repechage

Repechage is a cosmetic company that specializes in the development and marketing of professional skincare products and spa treatments. The company is particularly recognized for its seaweed-based products. Serving a global market, Repechage provides its specialized skincare solutions to beauty salons and individual consumers worldwide.

Potential implications and security considerations

The allegations made by the incransom group carry significant risks for the organization and its stakeholders. The potential exposure of employee contact information and job titles, combined with client and partner data, increases the risk of identity theft. Furthermore, these individuals may face a heightened risk of targeted phishing attacks, where attackers use stolen information to craft convincing fraudulent communications.

The claim that medical records have been compromised introduces a specific layer of risk. In the United States, the presence of such data could lead to significant legal and regulatory consequences for an organization under HIPAA regulations. Additionally, the incransom group appears to be utilizing double-extortion tactics. In these types of attacks, threat actors not only encrypt an organization's systems but also steal sensitive data, threatening to leak it to pressure the victim into paying a ransom. This tactic is designed to maximize pressure by threatening the organization's commercial reputation through the public release of proprietary or sensitive information.

Furthermore, the misuse of corporate data by third parties could create various risks for supply chain security. When partner data is compromised, the security of the entire business ecosystem may be challenged. While information regarding the incransom group remains limited, such incidents underscore the importance of robust data protection strategies. Organizations in the retail and e-commerce sectors often focus on implementing multi-factor authentication, continuous monitoring, and strict access controls to mitigate the risk of unauthorized data exfiltration and protect sensitive customer and employee information.