TBC listed on Inc Ransom leak site

• Ransomware group: Inc Ransom
• Country: Saudi Arabia
• Announcement date: July 9, 2025

The Inc Ransom ransomware group has listed the Saudi Arabian organization TBC on its leak site, claiming to have successfully executed a data breach against the entity. This announcement, discovered on July 9, 2025, suggests that the group has obtained data belonging to the organization.

The claimed attack and event details

According to the claim made by the Inc Ransom group, the cyberattack took place on July 8, 2025. The group's listing on their dedicated leak site serves as the primary evidence for their claim of a successful breach. While the group asserts that they have obtained the institution's data, the specific details regarding the timing and the nature of the intrusion remain limited to the information provided by the threat actor.

Ransomware groups often use leak sites to pressure victims into paying ransoms. These sites serve as a public bulletin board where attackers post the names of organizations they have compromised. By listing a target, the group aims to increase visibility and create psychological pressure on the victim. In this instance, the listing of TBC by Inc Ransom marks the beginning of a potential public disclosure process common in modern cyber extortion campaigns.

Details regarding the leaked data

At this stage, there is no information available regarding the nature of the leaked or threatened data. The listing does not specify the types of files, the volume of information, or the specific databases that may have been accessed during the alleged intrusion. Consequently, the listing names no data types.

In many ransomware scenarios, attackers utilize double-extortion tactics. This method involves not only encrypting an organization's systems to disrupt operations but also exfiltrating sensitive information prior to encryption. The threat of leaking this stolen data on a public site provides the attackers with additional leverage during negotiations. If the data is indeed exfiltrated, the risk of sensitive operational details being exposed to the public or competitors becomes a significant concern for the affected organization.

About TBC

TBC (Tatweer Buildings Company) is a government project management company owned by the Public Investment Fund (PIF) of Saudi Arabia. The company is tasked with the construction, maintenance, and management of educational buildings. Furthermore, TBC provides a wide range of services in operations, construction, facility management, and privatization to support Saudi Arabia's Vision 2030.

Impact assessment and organizational implications

Given the double-extortion tactics frequently employed by the Inc Ransom group, there may be a risk of sensitive operational data being leaked. TBC's position in government project management and the construction sector suggests that the breach could have negative impacts on corporate reputation and strategic projects. A successful leak of sensitive information could disrupt the continuity of major state-backed initiatives.

Furthermore, a data leak may lead to identity theft or targeted phishing attacks against employees and stakeholders. When personal or corporate information is compromised, attackers often use it to craft highly convincing social engineering campaigns designed to further penetrate the network or defraud individuals. The potential for such secondary attacks highlights the long-term risks associated with initial data breaches.

While public information about the Inc Ransom group is limited, similar ransomware cases indicate that the institution's operational continuity may be disrupted. Organizations operating in critical infrastructure or government-adjacent sectors often face increased risks from such actors. To mitigate these risks, organizations generally focus on robust backup strategies, network segmentation, and continuous monitoring to detect unauthorized data exfiltration. Maintaining a strong security posture is essential to protect strategic projects and maintain the trust of stakeholders and government entities.