earthsystems.com.au earthsystemseurope.com Listed by incransom Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On May 8, 2026, the ransomware group Incransom listed the domains earthsystems.com.au and earthsystemseurope.com on its leak site. The listing states that internal files were taken during a ransomware incident at Earth Systems. The number of people whose data may be affected is not known, and no further details on the volume or specific contents of the material have been made public. The incident matters because Earth Systems handles project documentation, client agreements and nondisclosure agreements that can contain information about third parties as well as the company itself. When such records are removed from an organisation’s control, the people and entities named in them face the possibility that the material will be published or used for further pressure.

Breaking down the breach

The only confirmed public information is the May 8, 2026 listing by Incransom. The group asserts that it exfiltrated internal files during a ransomware attack and that these files include corporate data, nondisclosure agreements, client contracts and project material. No independent confirmation of the claims has been reported. The number of records involved, the exact date of the intrusion, and the method used to gain access remain undisclosed.

Who is incransom?

Incransom is a ransomware operator that follows a double-extortion model. The group typically encrypts systems and removes copies of data, then lists the victim on a public leak site when a ransom demand is not met. Its listings usually describe the stolen material in general terms rather than releasing full archives immediately. The group has appeared in multiple public reports over recent years, though specific claims about any single victim are treated as unverified until corroborated by the affected organisation or independent investigators.

Earth Systems and its sector

Earth Systems operates as an environmental and engineering consultancy with offices in Australia and Europe. Organisations of this type routinely collect and store technical reports, site assessments, contractual documents and correspondence with clients and regulators. The data often includes details about third-party projects, land use, regulatory compliance and commercial arrangements. A breach at such a firm can therefore expose information that extends beyond the company’s own employees to external partners and project stakeholders.

What was likely exposed

The listing describes internal files that the group claims contain full corporate data, nondisclosure agreements, client contracts and project records. No official statement from Earth Systems has confirmed the precise categories or volume of material removed. In the absence of a detailed disclosure, it is not possible to state with certainty which individuals or entities are named in the files. Typical holdings at a consultancy of this kind would include names, contact details, project descriptions and contractual terms, but these remain unconfirmed in this case.

The real-world impact

Publication of client contracts and project documents could reveal commercial terms or technical information that parties to those agreements expected to remain private. Individuals whose names or personal details appear in the material may face increased risk of targeted phishing or social-engineering attempts. For the organisation, the exposure of internal records can complicate ongoing projects and client relationships even if no personal data of the general public is involved. The absence of a reported figure for affected people means the scale of personal exposure cannot yet be assessed.

What to do if you're exposed

Anyone who has worked with Earth Systems or its European entity should monitor their email and postal addresses for unusual activity. Basic steps include changing passwords for any accounts linked to the organisation, enabling multi-factor authentication where available, and reviewing privacy settings on professional profiles. Individuals can also run a free exposure scan of their email address against known breach data to check whether their information has appeared in previously published lists from other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.