MTTEXPERTISES.COM Listed by incransom Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People who have worked with MTT Expertises, whether as clients, partners or employees, may now face uncertainty about whether their personal or business information has been taken. The firm handles sensitive valuation and insurance-related work across Morocco, France and other African markets, so any exposure of internal files could affect individuals far beyond the company’s own staff.

Public reporting indicates that the ransomware group known as incransom has listed MTTEXPERTISES.COM on its leak site. The number of people affected remains unknown, and the precise contents of the material claimed to have been taken have not been independently confirmed. What is clear is that the listing itself raises practical concerns for anyone whose data may have been held by the firm.

What happened

On 6 June 2025 it was reported that MTTEXPERTISES.COM had been listed by the incransom ransomware group. According to the available information, the group claims that internal files were exfiltrated during a ransomware attack. No further public details have been released about the date of the intrusion, the method used to gain access, the volume of data involved, or whether any ransom demand was paid. The number of individuals whose information may have been affected is also unknown. The listing on the group’s leak site constitutes a claim by the attackers; independent verification of the full scope of the incident has not been published.

The group behind it: incransom

Incransom is a ransomware operation that has been observed conducting double-extortion attacks: encrypting systems while also stealing data and threatening to publish it if a ransom is not paid. Like other groups of this type, it maintains a dark-web leak site on which it posts the names of organisations it claims to have compromised, often accompanied by samples or larger data dumps when negotiations fail. Public reporting on prior campaigns shows that incransom typically targets mid-sized enterprises across multiple sectors and geographies, using common initial-access techniques such as phishing or exploitation of unpatched services before deploying ransomware and data-exfiltration tools. In this case the group has listed MTTEXPERTISES.COM and asserts that internal files were taken; those assertions remain the group’s own claims rather than independently confirmed findings.

MTTEXPERTISES.COM and its sector

MTT Expertises is a Franco-Moroccan firm founded in 2004 that specialises in asset valuation and post-incident expertise. Its services include insurance capital estimation, risk management and assistance after incidents. The company employs a multidisciplinary team of more than 40 professionals—engineers, technicians and financial experts—and operates from offices in Casablanca, Agadir and Tangier while maintaining a presence in France and other African countries. It is accredited by the Moroccan Federation of Insurance and Reinsurance Companies (FMSAR). Organisations of this kind routinely hold detailed financial records, insurance documentation, property valuations, client contact details and internal operational files. Because the firm sits at the intersection of insurance, risk assessment and post-incident recovery, a breach can affect not only its own staff but also policyholders, insurers and other businesses that rely on its reports.

What data was at risk

The only data type publicly named in connection with the incident is “internal files” said to have been exfiltrated in a ransomware attack. No inventory of specific file categories, no count of records, and no confirmation of whether personal data, financial statements, client contracts or employee information were included has been released. Firms that perform asset valuation and insurance-related expertise typically store client identities, property and asset details, insurance policy information, financial analyses, correspondence and internal administrative records. Whether any of those categories were among the material claimed by incransom remains unconfirmed. Readers should therefore treat the exact contents as undisclosed at this time.

The real-world impact

For individuals whose data may have been held by MTT Expertises, the practical risks include potential misuse of personal or financial information for fraud, targeted phishing, or identity-related scams. Business clients could face exposure of commercial valuations or insurance details that competitors or other parties might exploit. The organisation itself faces operational disruption, possible regulatory scrutiny under data-protection rules applicable in Morocco and France, and the longer-term task of restoring trust with clients and partners. Because the scale of the incident and the precise data involved are still unknown, the full extent of these consequences cannot yet be measured. Affected parties are advised to remain alert for unusual communications that reference the firm or its services.

Were you affected?

If you have been a client, employee or partner of MTT Expertises, treat the possibility of exposure seriously even though the exact data set remains unconfirmed. Monitor bank and insurance accounts for unexpected activity, enable multi-factor authentication on important online services, and be cautious of unsolicited emails or calls that claim to relate to the firm. You can also run a free exposure scan of your email address to check whether your information has already appeared in known breach data sets. Keep records of any suspicious contact and report confirmed fraud to the relevant authorities in your country.

AICompiled with AI assistance from public sources and published under our editorial standards.