Inc ransom group claims attack on “Previous Clients” on leak site

What happened

RansomLook, a leak-site tracker, reports that the inc ransom ransomware group claimed “Previous Clients” on its leak site. The tracker’s headline is dated 2026-11-10 RansomLook.

Only this headline could be fetched. The full article could not be reviewed, so this advisory goes no further than what the headline says.

Not confirmed:

• Whether the victim has acknowledged an incident. No victim statement was available.
• Whether any data was stolen or systems were encrypted.
• The entry point, the volume of data, and the real identity or nature of “Previous Clients”. The name may be a label rather than an organization.
• Any independent verification. The sources show no outlet other than a claim tracker.

A leak-site listing is a claim by the group, not proof of a breach.

Am I affected?

Not confirmed. The headline names only “Previous Clients” and gives no details about who is involved, which data is in scope, or which products or vulnerabilities were used. No CVE is named in the source.

If you are a customer, partner or employee of an organization using that name, the only sound step for now is to wait for a statement from the organization itself.

What to do now

1. Check the organization’s official channels for any incident notice, and rely on that rather than the leak-site listing.
2. Treat unexpected emails or calls that refer to this claim with caution, and verify them through a known contact.
3. Follow the RansomLook entry for updates. This advisory will be revised if a victim statement or an independent source appears.

Sources

• RansomLook: Previous Clients: claimed by the inc ransom ransomware group on its leak site