TransCore ITS, LLC targeted by crypto24 in alleged data breach

• Ransomware group: crypto24
• Country: United Arab Emirates
• Sector: Technology
• Announcement date: July 20, 2025

A significant data leak claim has been made by the threat actor known as crypto24 against the technology company TransCore ITS, LLC. According to an announcement posted on a leak site on July 20, 2025, the group alleges they have successfully exfiltrated a substantial amount of data from the organization.

The alleged attack details

The crypto24 group claims to have breached the internal network of the TransCore ITS, LLC office located in Dubai. While the announcement was published in July, the threat actor cites the actual date of the attack as March 31, 2025. This discrepancy between the time of the breach and the public announcement is a common occurrence in ransomware-related incidents, where actors may hold stolen data for several months before deciding to publish it on a leak site.

The group alleges that the volume of exfiltrated information is approximately 200 GB. It is important to note that no screenshot was provided by the group to substantiate these claims at the time of the announcement. Furthermore, no information regarding a ransom demand was included in the leak site post. In many modern cyberattacks, particularly those involving double extortion, threat actors aim to pressure organizations by threatening to release sensitive data on public forums if their demands are not met. This tactic shifts the focus from simple encryption to the reputational and legal risks associated with data exposure.

Data allegedly involved in the breach

The threat actor has specified several categories of information that they claim to have stolen from the organization's systems. The alleged exfiltration includes a variety of sensitive materials that could impact both the company's internal operations and its external relationships. The specific types of data mentioned include:

• Source code currently in development
• Full file sets from both active and archived client projects
• Internal financial records
• Customer data

The inclusion of source code and client project files is particularly sensitive, as it may expose the underlying logic of the company's proprietary technology and the specific details of the solutions provided to their clients.

About TransCore ITS, LLC

TransCore ITS, LLC is a technology company that specializes in the field of intelligent transportation systems (ITS). The organization provides a wide range of solutions, including software, hardware, and integration services. Their expertise is focused on critical infrastructure sectors such as transportation management, traffic management, and electronic toll collection systems.

Potential implications and industry risks

The claims made by crypto24 carry significant implications for TransCore ITS, LLC. The exposure of the alleged data could lead to the infringement of intellectual property rights and the disclosure of highly sensitive trade secrets, particularly if development-stage source code is indeed compromised. Additionally, the exposure of customer data poses secondary risks to the affected parties, such as the potential for identity theft or the execution of targeted phishing attacks.

Given the organization's specific sector and its geographic presence, such a breach could lead to legal sanctions regarding compliance with data protection regulations. Furthermore, the breach of third-party non-disclosure agreements could negatively impact the institution's existing business partnerships. In the technology and transportation sectors, maintaining the integrity of client project files and proprietary software is essential for trust and operational security.

Organizations operating in critical infrastructure and technology sectors often face these types of threats. To mitigate such risks, common defensive strategies include implementing robust network segmentation to prevent lateral movement, enforcing strict access controls, and maintaining comprehensive logging and monitoring to detect unauthorized access early. As information regarding the crypto24 group remains limited in the public domain, the incident highlights the ongoing challenges faced by technology firms in protecting sensitive intellectual and client data from sophisticated threat actors.