ITL Systemhaus Listed by incransom Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On November 26, 2025, the ransomware group incransom listed ITL Systemhaus für Datentechnik GmbH on its leak site. The listing states that internal files were exfiltrated during a ransomware attack. The number of individuals whose information may be involved remains unknown, as does the precise volume or content of any material taken. The incident matters because ITL Systemhaus provides IT services and maintains the dental software DENTIXsoft used by more than 300 customers. Any exposure of internal records from such an organisation can affect both the company’s direct clients and the patients or users whose data those clients process.

Breaking down the breach

The only confirmed public detail is the listing itself, reported on November 26, 2025. No information has been released about when the intrusion occurred, how long the attackers had access, or the method used to gain entry. The scale of the operation—measured either by the number of files removed or the number of people potentially affected—has not been disclosed.

Who is incransom?

Incransom is a ransomware operation that publishes victim names on a dedicated leak site when negotiations fail or ransom demands are not met. The group follows the common pattern of encrypting systems and threatening to release stolen data. Its listing of ITL Systemhaus constitutes a claim by the group; independent confirmation of the data’s authenticity or extent has not been made public.

About ITL Systemhaus

ITL Systemhaus für Datentechnik GmbH was founded in 1991 and employs more than 25 staff. The company supplies a range of IT services and has maintained its own training facilities since relocating to Münchberg in 2005. In 2010 it acquired the dental practice software DENTIXsoft, which serves over 300 customers across Germany. Organisations of this type routinely handle administrative records, client configurations, and support data for healthcare-adjacent customers.

What data was at risk

The listing refers only to “internal files.” No further inventory of file types, customer records, or personal data categories has been published. While firms providing IT services and dental software commonly store configuration details, user credentials, and business correspondence, the exact contents removed in this case remain unconfirmed.

Why it matters

Internal files held by an IT service provider can include configuration information and client communications that, if disclosed, may be used for further targeting or social-engineering attempts. For dental practices using DENTIXsoft, any downstream exposure could involve administrative records whose sensitivity depends on what was stored. The absence of a confirmed record count leaves both the company and its clients without a clear basis for assessing individual impact.

Were you affected?

ITL Systemhaus has not published a notification process or confirmation mechanism. Individuals who are customers or partners of the company can contact it directly for information on any steps it is taking. A short list of immediate actions includes:

• Monitor official statements from ITL Systemhaus for any future disclosures.
• Review account activity for any services linked to the company or its software.
• Run a free exposure scan of your email address against known breach data sets to check for prior appearances.

No public timeline for additional details has been announced.

AICompiled with AI assistance from public sources and published under our editorial standards.