Thiekon Constructie listed on Inc Ransom leak site

• Ransomware group: Inc Ransom
• Country: Netherlands
• Sector: Manufacturing
• Announcement date: April 8, 2025

Thiekon Constructie targeted by Inc Ransom

The Netherlands-based organization Thiekon Constructie has been listed on the leak site of the ransomware group known as Inc Ransom. According to the announcement made on April 8, 2025, the threat actor claims to have successfully targeted the company and obtained its data. This listing serves as a public declaration of the breach, a common tactic used by modern ransomware groups to exert pressure on their victims.

Details of the claimed attack

The Inc Ransom group officially listed Thiekon Constructie on its leak site on April 8, 2025, asserting that they have gained access to the company's internal information. To support their claims, the group has published various documents as evidence. These published materials appear to contain a mix of operational and personal information belonging to the organization. This specific method of publication is widely recognized as a double-extortion tactic. In such scenarios, threat actors do not merely encrypt a victim's systems to disrupt operations; they also steal sensitive data and threaten to release it publicly to increase the pressure on the organization to pay the ransom.

The group's activities demonstrate a pattern of using data exposure as a primary leverage tool. By moving from simple encryption to the threat of public disclosure, attackers aim to maximize the impact of their campaign, targeting both the operational continuity and the reputational standing of the victimized entity.

Data types involved in the leak

Based on the evidence provided by the threat actor, the leaked information includes a variety of sensitive documents. The screenshots released by the group indicate that the stolen data encompasses both commercial and personal information. The specific types of data identified include:

• Technical drawings
• Contracts
• Invoices
• Personal identification data

The presence of personal identification data, such as a sample of a driver's license, highlights the potential risk to individuals associated with the company. When personal documents are exfiltrated, the breach extends beyond corporate assets and directly impacts the privacy of individuals.

About Thiekon Constructie

Thiekon Constructie is a Dutch company with over 40 years of experience in steel structures and zinc coatings. As the only company in the country with its own hot-dip galvanizing plant, it provides steel fabrication, assembly, and powder coating services under one roof.

Impact and security implications

The Inc Ransom group has been an active threat actor since mid-2023, and this incident underscores the ongoing risks posed by their double-extortion tactics. The exposure of the data claimed by the group could lead to significant consequences for Thiekon Constructie. The potential leak of personal information belonging to employees or customers increases the risk of identity theft, as sensitive identification details are made available to malicious actors.

Furthermore, because the company is based in the Netherlands, this incident may be subject to data protection violations and legal sanctions under the General Data Protection Regulation (GDPR). Beyond legal and regulatory risks, the publication of technical and commercial documents, such as technical drawings and contracts, could weaken the company's supply chain security. Such information can be used by attackers to facilitate highly targeted phishing attacks or other sophisticated social engineering campaigns against the company or its partners.

The group's past activities suggest that the release of such data can result in significant reputational damage and operational disruptions for the organization. For companies in the manufacturing and construction sectors, maintaining robust cybersecurity measures is essential to protect intellectual property and sensitive commercial data. Organizations can mitigate these risks by implementing strict access controls, maintaining offline backups, and conducting regular security awareness training to defend against the phishing attempts that often follow such breaches.