https://daricon.com/ (military US/CA/NATO) Listed by incransom Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

The organization operating at https://daricon.com/, which maintains contracts with military entities in the United States, Canada, and NATO, was listed by the incransom ransomware group on February 26, 2026. Public information at this stage is limited to the listing itself and a summary of claimed data; no independent confirmation of the incident, the number of individuals affected, or the precise contents of any files has been released.

What happened

On February 26, 2026, the incransom group added https://daricon.com/ to its leak site. The listing states that internal files were exfiltrated during a ransomware operation. No further details on the date of the intrusion, the method of access, or any ransom demand have been made public. The number of people affected is reported as unknown.

The group behind it: incransom

Incransom is a ransomware operator that maintains a public leak site to pressure victims. Like other groups in this category, it typically claims to have copied data before encryption and then publishes samples or descriptions to encourage payment. Its listings have covered organizations across multiple sectors in prior incidents, though each claim requires separate verification.

https://daricon.com/ (military US/CA/NATO) Listed by incransom Ransomware Group and its sector

The listed organization works with defense and military customers in the United States, Canada, and NATO. Entities in this sector routinely handle correspondence, contract documentation, technical drawings, and personnel records tied to equipment shipments and international projects. A listing involving such an organization raises questions about the handling of sensitive but unclassified material even when classified networks remain separate.

What was likely exposed

The listing describes 400 GB of data that includes internal files. Exact confirmation of the contents has not been provided by the organization or by investigators.

• Correspondence with NATO and US Army employees
• Confidential documents and signatures of NATO generals
• Passport addresses, phone numbers, and other personal data of employees
• Shipment records, photos, videos, and drawings
• Emails and contracts involving US, Canadian, and NATO military entities
• Documentation on partner companies in sectors such as oil operations

Why it matters

Even without Reported Details, the exposure of employee contact information, contract records, and operational correspondence can create follow-on risks such as targeted phishing or supply-chain scrutiny. For the organization, the incident may affect ongoing relationships with government customers that require evidence of data-handling controls. For individuals named in the files, the primary concern is the potential misuse of personal identifiers already in circulation from other sources.

What to do if you're exposed

Individuals who believe their information may be involved should monitor official statements from the organization and any notifications issued through contracting partners. Practical first steps include reviewing recent account activity for unusual access, enabling multi-factor authentication on work and personal accounts, and treating unsolicited messages that reference military or contract topics with caution. Readers can run a free exposure scan of their email address against known breach data to check for prior appearances of their information.

AICompiled with AI assistance from public sources and published under our editorial standards.