Töller data allegedly leaked by Inc Ransom

• Ransomware group: Inc Ransom
• Country: Belgium
• Sector: Professional Services
• Announcement date: August 15, 2025

Inc Ransom claims data breach at Töller

The Inc Ransom ransomware group has published an announcement on its leak site claiming responsibility for a data breach involving the Belgian organization Töller. According to the post made on August 15, 2025, the threat actor group alleges it has gained unauthorized access to the organization's sensitive financial and operational information. The group claims that the initial intrusion and subsequent compromise occurred on July 7, 2025.

Ransomware leak sites are platforms used by cybercriminal groups to pressure victims into paying ransoms. These groups often employ a strategy known as double extortion. In a double extortion scheme, attackers do not merely encrypt an organization's files to disrupt operations; they also exfiltrate sensitive data before the encryption occurs. The threat of leaking this stolen data on a public website provides the attackers with additional leverage, as the victim faces not only operational downtime but also significant reputational damage and potential legal liabilities if the data is released.

Details of the alleged data theft

The announcement made by Inc Ransom specifies that the stolen information encompasses a wide range of internal and external data. The group claims to have obtained various types of sensitive documentation that could impact multiple stakeholders of the organization. The specific categories of data mentioned in the claim include:

• Customer personal data
• Financial data
• Supplier agreements
• Marketing data
• HR data

While the group has identified these categories, no specific information was provided regarding the total volume of the data stolen or the exact number of files involved. Furthermore, no information was provided regarding a specific ransom demand or the organization's response to the incident.

About Töller

Töller is a company based in Belgium that operates primarily within the logistics, transportation, and customs brokerage sectors. The organization provides professional consulting and operational support specifically designed for international trade processes, making it a key player in the movement and regulation of goods across borders.

Potential impact and security implications

The alleged breach of Töller could result in several significant risks. For the organization's employees and customers, the exposure of personal and financial information increases the risk of identity theft and the likelihood of targeted phishing attacks. Because Töller is based in Belgium, the leaked data is likely subject to the General Data Protection Regulation (GDPR), which could lead to legal consequences for the entity if the breach is found to be a result of non-compliance with data protection standards.

Furthermore, the publication of partnership and supplier agreements could create opportunities for supply chain attacks. In such scenarios, attackers use the information gained from one organization to target its business partners, exploiting the trust and established connections between them. The disclosure of these documents can also cause lasting damage to the organization's commercial reputation.

Inc Ransom is a ransomware group that emerged in mid-2023 and is known for utilizing these double-extortion tactics. To defend against such threats, organizations in the logistics and professional services sectors often implement multi-layered security strategies. These include robust access controls, regular security awareness training to prevent phishing, and comprehensive monitoring of network activity to detect unauthorized data exfiltration. Maintaining offline, immutable backups and ensuring strict adherence to data protection regulations are also critical components of a modern defensive posture against ransomware groups.