Tract Consulting listed on incransom leak site

• Ransomware group: incransom
• Country: Canada
• Sector: Professional Services
• Announcement date: February 27, 2026

The professional services firm Tract Consulting has been listed on the leak site of the ransomware group known as incransom. The threat actors behind the group claim to have successfully compromised the organization's data and have threatened to release the stolen information publicly.

The incransom claim

According to an announcement published on February 27, 2026, the incransom group has targeted Tract Consulting. The threat actor claims to have exfiltrated the firm's data and has issued a deadline, stating that all stolen files will be published within one week. This announcement follows a claimed attack date of February 26, 2026.

The incransom group is a ransomware entity that emerged in mid-2023. The group is known for employing double-extortion tactics. In a typical double-extortion scenario, attackers do not merely encrypt a victim's systems to disrupt operations; they also steal sensitive data before the encryption process begins. This allows the attackers to exert additional pressure on the organization by threatening to leak the stolen information on public leak sites if the ransom is not paid. This method is specifically designed to increase the likelihood of a successful payout by leveraging the threat of reputational damage and regulatory scrutiny.

Data involved in the alleged breach

The leak site listing includes screenshots that display a list of files and preview images. These visual elements are claimed to include various types of sensitive internal documentation. The specific categories of data identified in the claim include:

• Financial documents
• Project files
• Internal correspondence

No information was provided regarding the total size of the data or the specific number of files involved in the incident. Furthermore, no ransom demand has been specified in the current listing.

About Tract Consulting

Tract Consulting is an award-winning consulting firm specializing in landscape architecture, urban planning, and civil engineering. Based in Newfoundland and Labrador, Canada, the company provides urban improvement projects and community-focused design strategies for municipalities and various organizations.

Impact and industry considerations

This incident may pose a significant risk to the operational continuity and data privacy of Tract Consulting. The potential public disclosure of the alleged data could damage the firm's commercial reputation and erode client trust. Because the firm operates in Canada, a potential data breach may trigger legal obligations under the Personal Information Protection and Electronic Documents Act (PIPEDA).

Furthermore, the possibility of the leaked data being used for identity theft or targeted phishing attacks should be considered. When sensitive internal correspondence and financial documents are exposed, it provides malicious actors with the context needed to craft highly convincing social engineering attacks against employees or clients.

For organizations operating within the professional services sector, such incidents highlight the necessity of robust defensive measures. Common defensive steps for organizations to mitigate the risks of ransomware and data exfiltration include maintaining rigorous backup protocols, implementing multi-factor authentication across all systems, and conducting regular employee security awareness training. Additionally, monitoring for unauthorized data transfers and ensuring strict access controls can help reduce the likelihood of a successful exfiltration event.