Fund for Reformed Companies (FONPER) Listed by incransom Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target public-sector bodies that hold sensitive administrative and financial records, often using double-extortion tactics that combine encryption with data theft. Against that backdrop, the Fund for Reformed Companies (FONPER), a Dominican State institution, was listed by the incransom ransomware group on 17 June 2025. Public detail remains limited, yet the claim that internal files were exfiltrated underscores the exposure risk for any organisation that manages state assets and related documentation.

The listing itself is an unverified claim by the group; no independent confirmation of the full scope or method has been released. What is known is that FONPER’s role in safeguarding state shareholdings makes any compromise of its systems consequential for both the institution and the people whose information may appear in those records.

Breaking down the breach

According to the available record, the Fund for Reformed Companies (FONPER) was listed by the incransom ransomware group on 17 June 2025. The group claims that internal files were exfiltrated in a ransomware attack. The number of people affected is unknown, and further details—such as the precise date of intrusion, the volume of data taken, the encryption status of systems, or any ransom demand—have not been disclosed. No official statement confirming or denying the claim has been included in the public facts. The incident is therefore characterised solely by the group’s leak-site listing and the description of internal files as the material involved.

Inside incransom

Incransom is a ransomware operation that has been observed conducting double-extortion campaigns: encrypting systems while also stealing data and threatening to publish it if payment is not made. Like many contemporary groups, it typically advertises victims on a dedicated leak site and uses that platform both to pressure organisations and to attract attention from other actors. Public reporting on the group describes a pattern of opportunistic targeting across sectors rather than exclusive focus on any single industry. The listing of FONPER is presented by the group as evidence of a successful intrusion and data theft; beyond that claim, no additional statements specific to this victim have been recorded in the available facts. Established knowledge of the group’s methods therefore informs the broader context, but does not substitute for Reported Details about the FONPER incident itself.

Fund for Reformed Companies (FONPER) and its sector

The Fondo Patrimonial de las Empresas Reformadas (FONPER) is an institution of the Dominican State created by Law number 124-01, enacted on 24 July 2001. Its fundamental mission is to watch over, safeguard and administer the State’s shares in the companies that emerged from the reform and transformation process carried out as of 1997. As a public-sector entity responsible for state equity holdings, FONPER operates at the intersection of government administration and corporate oversight. Organisations of this type routinely handle corporate records, shareholding documentation, financial statements, correspondence with privatised or reformed enterprises, and related administrative files. A breach affecting such an institution raises concerns not only for operational continuity but also for the confidentiality of information that may touch on public assets, commercial partners and, potentially, individuals connected to those entities.

What data was at risk

The facts name the exposed material as internal files exfiltrated in a ransomware attack. No further breakdown—such as employee records, financial ledgers, personal identifiers, or third-party contracts—has been provided. Because the exact contents remain unconfirmed, it is not possible to state with certainty which categories of data were taken. Institutions that administer state shareholdings typically maintain corporate governance documents, valuation reports, legal agreements, correspondence and internal operational files; any of these could fall under the broad description of “internal files.” Until more precise inventories are released by the organisation or verified independently, the nature of the compromised data must be treated as limited to the group’s claim of internal-file exfiltration.

The real-world impact

For individuals whose details may appear in FONPER’s records, the primary risks include potential misuse of personal or financial information if such data were present among the internal files. Even without confirmed personal identifiers, the exposure of administrative or commercial documents can enable social-engineering attempts, fraud targeting related companies, or reputational harm. For the organisation itself, the consequences may include operational disruption, the need for forensic investigation and system remediation, possible regulatory scrutiny, and the longer-term task of restoring confidence among stakeholders. Because the number of people affected is unknown and the precise data types are undisclosed, the scale of individual harm cannot yet be quantified; the risk remains real but currently unmeasured. Public institutions that manage state assets also face secondary effects, such as questions about the security of other government-linked entities and the broader integrity of reform-related records.

Were you affected?

If you have had dealings with FONPER, with companies under its oversight, or with Dominican State reform processes, treat any unexpected contact requesting personal or financial details with caution. Monitor financial statements and credit activity for unusual transactions, and consider placing fraud alerts where available. Change passwords on accounts that may have been linked to related correspondence, and enable multi-factor authentication wherever possible. Readers can also run a free exposure scan of their email address to check whether their information has already surfaced in known breach data sets. Should official notifications or further disclosures emerge from FONPER or Dominican authorities, follow the guidance they provide. In the meantime, the limited public facts mean that vigilance, rather than panic, is the most practical response.

AICompiled with AI assistance from public sources and published under our editorial standards.