Ejército del Per Listed by incransom Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On March 25, 2024, the Peruvian Army, known as Ejército del Perú, was listed by the ransomware group incransom. Public reporting indicates the group claims to have carried out a successful cyber attack and obtained a large volume of classified information from the Ministry of Defense and the army. The number of people affected remains unknown, and available details describe the exposure as internal files exfiltrated in a ransomware attack.

This listing matters because military organizations hold sensitive operational, personnel, and national-security data. Even when exact contents and confirmation of the breach are limited, such claims raise concrete risks for the institution and anyone whose information may have been involved.

Inside the incident

According to the reported summary associated with the listing, incransom stated that it presents “the Mystery of Defense and the Army of Peru” and that, as a result of a successful cyber attack, it has at its disposal a huge amount of classified information belonging to these entities. The facts identify the exposed material as internal files exfiltrated in a ransomware attack. Timing of the intrusion itself, the precise method of initial access, the scale of systems affected, and independent confirmation of the claims are not disclosed in the available record. The listing date is March 25, 2024; the number of individuals whose data may have been involved is unknown.

No further technical indicators, ransom demands, or verification of file contents appear in the public facts provided. The incident is therefore known primarily through the group’s leak-site claim rather than through detailed official confirmation.

Who is incransom?

incransom is a ransomware operation that follows the well-documented double-extortion model used by many modern groups. After gaining access to a network, such actors typically encrypt systems and also exfiltrate data, then threaten to publish the stolen material on a dedicated leak site if payment is not made. Groups of this type commonly target organizations that hold valuable or sensitive information, including government and defense-related entities, and they publicize victims to increase pressure.

Public knowledge of incransom’s broader activity shows it has listed multiple organizations across sectors. For this specific case, the only claim that can be reported is the one contained in the listing itself: that the group obtained a large volume of classified information from the Peruvian defense and army structures. No additional statements by the group about this victim are present in the facts, and the listing remains an unverified claim unless independently confirmed.

Who is Ejército del Per?

Ejército del Perú is the land component of the Peruvian Armed Forces. As a national military organization it is responsible for defense, territorial security, and related operations under the Ministry of Defense. Institutions of this type routinely manage classified operational plans, intelligence products, personnel records, logistics data, communications systems, and other sensitive government information.

A breach affecting such an organization is consequential because the data it holds can include details about serving and former personnel, contractors, operational readiness, and national-security matters. Compromise of that material can affect institutional readiness, individual privacy and safety, and broader public confidence in the protection of state information. The facts do not establish negligence or specific security failures; they simply record the group’s claim of successful access and exfiltration.

What was likely exposed

The facts name the exposed material as internal files exfiltrated in a ransomware attack and quote the group’s assertion that it holds a huge amount of classified information belonging to the Ministry of Defense and the Army of Peru. Exact file names, volumes, or categories beyond that description are not disclosed.

Organizations of this kind typically store personnel files, identity and contact data, medical or administrative records, operational documents, procurement and logistics information, and other classified or restricted material. Because the precise contents remain unconfirmed, it is not possible to state which of these categories, if any, were actually taken. Readers should treat the group’s description as a claim rather than verified inventory.

The real-world impact

For individuals whose data may have been among the internal files, potential consequences include identity misuse, targeted phishing or social-engineering attempts that reference military affiliation, and, in more serious cases, risks to personal safety if sensitive personal or operational details are published. Serving and former personnel, civilian employees, and contractors are the populations most likely to be affected if personnel-related records were included.

For the organization, the impact centers on possible exposure of classified or operationally sensitive material, disruption of systems during the attack, and the need to investigate, contain, and recover. Even when the full extent is unknown, such incidents can require resource-intensive response efforts and may affect trust among partners and the public. No confirmed count of affected people or confirmed dollar costs is available in the facts.

If your data was in this claimed breach

If you have a connection to the Peruvian Army or Ministry of Defense—as a current or former service member, employee, contractor, or family member—treat the possibility of exposure seriously even though the exact contents remain unconfirmed. Monitor financial and government accounts for unusual activity, enable multi-factor authentication wherever available, and be cautious of unsolicited messages that reference military service or personal details. Consider placing fraud alerts with credit bureaus if you are concerned about identity theft.

You can also run a free exposure scan of your email address to check whether your information has already appeared in known breach data sets. This step does not confirm or rule out involvement in this specific incident, but it provides a practical way to see whether your credentials or personal data have surfaced elsewhere and to take further protective measures if needed.

AICompiled with AI assistance from public sources and published under our editorial standards.