Elemetal Listed by incransom Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 18 September 2023, the precious-metals firm Elemetal appeared on a ransomware group’s leak site. Public detail remains limited: the number of people affected is unknown, and the only confirmed description of the material is that internal files were allegedly exfiltrated. For anyone who has done business with a major refiner—employees, counterparties, or customers whose records may sit in those systems—the practical stake is straightforward. Once internal files leave an organisation, the people named in them can face identity misuse, targeted fraud, or unwanted exposure of commercial and personal details, often long after the initial incident fades from headlines.

What is known comes largely from the listing itself and from the group’s accompanying claims. Independent confirmation of the full scope has not been made public, so the picture stays incomplete. That uncertainty does not remove the need for vigilance; it simply means affected individuals must treat the risk as real until clearer information emerges.

Inside the incident

According to reporting dated 18 September 2023, Elemetal was listed by the ransomware group known as incransom. The group stated that internal files had been exfiltrated in a ransomware attack. Public sources do not disclose the precise date of intrusion, the initial access method, or whether encryption was also deployed on internal systems. The number of people affected remains unknown.

In its leak-site material the group claimed Elemetal is one of the largest precious-metals refiners, asserted that the company was “laundering money for drug cartel,” stated that the “cost of their privacy is $160.000,” and referred to “600GB of” data. These statements are claims made by the threat actor; they have not been independently verified in the available record. No further technical indicators, file inventories, or victim confirmations have been released in the facts at hand.

Inside incransom

Incransom (also styled Inc Ransom) is a ransomware operation that became active in the public eye around 2023. Like many contemporary groups, it typically follows a double-extortion model: data is copied out of the victim environment before, or instead of, encryption, and the group then threatens to publish the material on a dedicated leak site if a payment is not made. Listings often include short taunting statements, purported data volumes, and ransom figures intended to pressure the organisation.

The group has been observed targeting a range of sectors rather than a single industry niche. Its public posts frequently mix factual-sounding details with unverified accusations. Because leak-site entries are controlled by the attackers, every specific allegation—about volume, content, or the victim’s conduct—must be read as a claim until corroborated by the organisation or by independent investigators. In the Elemetal case, the listing and the accompanying text constitute such a claim; they do not by themselves establish the full facts of the intrusion or the accuracy of the group’s narrative.

Elemetal and its sector

Elemetal operates in the precious-metals refining sector. Firms of this type receive, assay, melt, and refine gold, silver, and other metals, then return refined product or settle accounts with mining companies, dealers, jewellers, and financial counterparties. The work routinely involves detailed transaction records, know-your-customer and anti-money-laundering documentation, shipping and inventory data, employee records, and commercial contracts.

A breach at a refiner is consequential because the sector sits at the intersection of physical commodities and regulated finance. Internal files can contain identities of suppliers and customers, banking and settlement details, compliance files, and operational data that competitors or criminals could misuse. Even when the exact contents of a given incident remain unconfirmed, the category of organisation makes clear why exfiltrated material can affect people well beyond the company’s own payroll.

What data was at risk

The facts name the exposed material only as “internal files exfiltrated in ransomware attack.” No itemised list of data types—such as names, government identifiers, financial account numbers, or medical information—has been disclosed in the public record summarised here. The group’s reference to roughly 600 GB is likewise an unverified claim.

Organisations in precious-metals refining typically hold customer and supplier onboarding files, transaction and assay records, employee personal data, internal correspondence, and compliance documentation. Whether any or all of those categories were present in the taken files is unconfirmed. Readers should therefore treat the precise contents as unknown while recognising that internal corporate archives of this kind often include information that can be used for fraud or social engineering.

The real-world impact

For individuals whose details may appear in the files, the concrete risks include phishing and social-engineering attempts that reference real transactions or relationships, account-takeover efforts if contact or identity data were present, and longer-term exposure if documents surface on criminal forums. Because the count of affected people is unknown, it is impossible to say how widely those risks extend; anyone with a past or present relationship to Elemetal has reason to monitor for unusual activity.

For the organisation, the incident carries operational, regulatory, and reputational consequences common to ransomware events involving data theft: potential disruption of refining and settlement workflows, scrutiny from compliance authorities, and the need to investigate and contain any residual access. None of these outcomes has been detailed in the available facts, and no public statement confirming or denying the group’s claims is recorded here.

What to do if you're exposed

If you believe your information may have been held by Elemetal, take measured steps rather than reacting to unverified claims.

• Monitor bank, credit-card, and other financial statements for unfamiliar activity and enable transaction alerts where available.
• Treat unexpected emails, calls, or messages that reference metals transactions, invoices, or personal details with caution; verify through known official channels before responding or clicking links.
• Consider placing a fraud alert or credit freeze with major credit bureaus if you have reason to think identity data was involved.
• Update passwords on important accounts, especially any reused across work and personal services, and turn on multi-factor authentication.
• Keep records of any suspicious contact so you can report patterns to your bank or to law enforcement if needed.

You can also run a free exposure scan of your email address to check whether your information has already surfaced in known breach data sets. That check does not confirm or rule out involvement in this specific incident, but it can indicate whether your address appears in other circulated collections and help you prioritise further monitoring.

AICompiled with AI assistance from public sources and published under our editorial standards.