Alios Finance Group Listed by incransom Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 28 October 2025, the ransomware group known as incransom listed Alios Finance Group on its leak site, claiming to have exfiltrated internal files in a ransomware attack. Public detail remains limited: the number of people affected is unknown, and no independent confirmation of the claim has been provided in the available record. For customers, employees and partners of a financial-services operator active across multiple African markets, the practical stakes are clear. Financial firms routinely hold identity documents, account details, transaction histories and other personal or commercial records; any unauthorised access to such material can expose individuals to fraud, identity misuse or unwanted contact long after the initial incident.

This article sets out only what has been reported, places the claim in the context of how incransom typically operates, and outlines the concrete risks and first steps for anyone who may be connected to the organisation.

Inside the incident

According to the listing attributed to incransom, Alios Finance Group was the subject of a ransomware attack in which internal files were exfiltrated. The group has claimed that the material consists of 100 GB of “fresh data” covering the last three years. The date associated with the public report is 28 October 2025. No further technical details—such as the initial access method, the precise systems affected, or whether encryption was also deployed—have been disclosed in the available facts. The number of individuals whose information may be involved is listed as unknown. Because the information originates from a threat-actor leak site, it must be treated as an unverified claim unless and until the organisation or independent investigators state it.

The group behind it: incransom

Incransom is a ransomware operation that follows the now-common double-extortion model: after gaining access to a network, operators typically exfiltrate data and then threaten to publish or sell it if a ransom is not paid. Groups of this type maintain dedicated leak sites where they post victim names, sample files and claims about the volume of stolen data in order to increase pressure. Public reporting on incransom has described it as one of several actors that target organisations across multiple sectors and geographies, often advertising large data volumes and recent time ranges to suggest the material is current and valuable. The group’s listing of Alios Finance Group is therefore consistent with its established pattern of public claims; it does not, by itself, constitute independent verification of the breach or of the exact contents of any archive.

Alios Finance Group and its sector

Alios Finance Group describes itself as a leading operator in Africa providing specialised financial solutions to professionals and individuals. It operates in nine Sub-Saharan countries—Burkina Faso, Cameroon, Ivory Coast, Gabon, Kenya, Mali, Senegal, Tanzania and Zambia—and is also present in North Africa (Algeria and Tunisia) through its main shareholder, Tunisie Leasing Group. Organisations of this kind typically act as intermediaries or providers of credit, leasing and related financial products. As a result they hold customer identity and contact data, account and contract records, payment histories and internal commercial documents. A breach affecting such an entity is consequential because the data often combines personally identifiable information with financial details that can be reused for fraud or social-engineering attacks across the multiple jurisdictions in which the group is active.

What data was at risk

The facts state that internal files were exfiltrated in a ransomware attack and that the claimed volume is 100 GB of data from the last three years. No more granular inventory—such as specific categories of customer records, employee files or system logs—has been publicly disclosed. Financial-services organisations of this type commonly store identity documents, contact details, account numbers, loan or leasing contracts, transaction histories and internal correspondence. Whether any or all of those categories are present in the claimed archive remains unconfirmed. Readers should therefore treat the precise contents as unknown pending further official statements or independent analysis.

The real-world impact

For individuals whose data may be involved, the principal risks are identity theft, account takeover and targeted phishing that leverages accurate personal or financial details. Even limited internal files can contain enough information to craft convincing scams or to open fraudulent accounts. For the organisation itself, the consequences can include regulatory scrutiny in the countries where it operates, contractual obligations to notify customers or partners, operational disruption and reputational harm. Because the scale of affected individuals is unknown and the data types have not been itemised beyond “internal files,” the full extent of exposure cannot yet be quantified. The claim of 100 GB of recent material, if accurate, suggests a non-trivial volume that could affect both current and recent customers across the group’s African footprint.

Were you affected?

If you are a customer, employee or partner of Alios Finance Group, or have had dealings with its operations in any of the listed countries, treat the possibility of exposure seriously until more information becomes available. Practical first steps include:

• Monitor bank and credit accounts for unexpected activity and enable transaction alerts where available.
• Be cautious of unsolicited emails, calls or messages that reference your relationship with the group or request personal or financial details.
• Change passwords on any accounts that may have used the same credentials as those shared with the organisation, and enable multi-factor authentication.
• Request a free credit report or equivalent local credit check if available in your country, and place fraud alerts if appropriate.
• Run a free exposure scan of your email address against known breach data sets to see whether your information has already appeared in other incidents.

Official confirmation or further detail from Alios Finance Group or relevant authorities should be followed as it becomes available. Until then, the listing by incransom remains an unverified claim, and the exact scope of any data exposure is still unknown.

AICompiled with AI assistance from public sources and published under our editorial standards.