Xerox listed on Inc Ransom leak site following claims of data exfiltration

• Ransomware group: Inc Ransom
• Country: United States
• Sector: Technology
• Announcement date: September 14, 2025

Inc Ransom claims to have targeted Xerox

The Inc Ransom ransomware group has officially listed Xerox on its dedicated leak site. Through an announcement made on September 14, 2025, the threat actor group claims to have successfully exfiltrated data belonging to the multinational technology corporation. This incident follows a claimed attack date of April 10, 2024, though the group's announcement regarding the data breach was made much later.

The group's post on their leak site outlines a targeted operation against the organization. According to the information provided by the attackers, the stolen data is organized into several distinct categories. The group has identified three specific sections within the allegedly stolen datasets, which they claim are directly related to the company's internal operational processes. These sections are categorized under the headings "Vendors", "AP Approval", and "Other files".

Details of the allegedly stolen data

Based on the screenshots provided by the Inc Ransom group in their announcement, the data involved in this purported breach is categorized into specific operational areas. The group claims that the exfiltrated information includes sensitive business documentation. Specifically, the listing identifies the following types of affected data:

• Vendor information
• Accounts payable data

While the group has provided these categories, they have not disclosed the total volume of the data or the specific number of files involved in the breach. Furthermore, no specific ransom demand has been made public in the source material provided by the group.

About Xerox

Xerox Corporation is a multinational technology company that provides document management solutions, digital printing systems, and related services worldwide. The company offers a wide portfolio of hardware and software, ranging from desktop printers to large-scale production printing systems.

Analysis and potential implications

This incident involves claims by the Inc Ransom group that it has exfiltrated corporate data using double-extortion tactics. In a double-extortion scenario, threat actors do not merely encrypt a victim's systems to disrupt operations; they also steal sensitive information to use as leverage. The threat of leaking this data publicly is used to pressure the organization into paying a ransom to prevent the exposure of confidential information.

Given the company's position in the technology and document management sector, it is possible that the leaked data could increase supply chain risks. When a major provider of document and printing solutions is targeted, the potential for downstream effects on partners and clients must be considered. Furthermore, the leaked financial approval documents could potentially facilitate targeted phishing attacks against the company's business partners. Such attacks often use stolen financial or vendor information to impersonate legitimate entities to trick partners into making fraudulent payments.

As a US-based entity, the company may face data breach notification obligations under relevant state laws and federal regulations. Organizations facing similar threats often focus on robust data loss prevention, strict access controls, and comprehensive employee training to mitigate the risks of exfiltration. The Inc Ransom group has been known to be active since mid-2023 and has targeted corporate networks using similar methods.