onsolve.com Listed by incransom Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to single out technology and service providers that sit at the centre of organisational resilience, turning operational platforms into high-value targets for data theft and extortion. In this environment, even listings that remain unverified can create lasting uncertainty for customers, partners and employees whose information may have been caught up in an attack.

On 1 November 2025 the domain onsolve.com appeared on a leak site operated by the ransomware group known as incransom. Public reporting states that internal files were exfiltrated during a ransomware attack; the number of people affected remains unknown and further technical detail has not been released. The listing itself is a claim by the group and has not been independently confirmed.

What happened

According to the available record, onsolve.com was listed by the incransom ransomware group on 1 November 2025. The only concrete description supplied is that internal files were allegedly exfiltrated in a ransomware attack. No public statement has confirmed the precise date of initial access, the volume of data taken, the encryption status of systems, or any ransom demand. The number of individuals potentially affected is recorded as unknown. Method of intrusion and any subsequent negotiation remain undisclosed.

The group behind it: incransom

Incransom is a ransomware operation that has been observed conducting double-extortion campaigns: encrypting victim systems while simultaneously stealing data and threatening to publish it if payment is not made. Like other groups in this category, it maintains a dedicated leak site on which it posts victim names and, at times, sample files to increase pressure. Public reporting on earlier incidents attributes to the group the use of common initial-access techniques such as compromised credentials or vulnerable remote services, followed by lateral movement and data staging. In the present case the group claims to have listed onsolve.com and to have exfiltrated internal files; those assertions have not been corroborated by independent sources or by the organisation itself in the material available here.

Who is onsolve.com?

OnSolve is described as a critical-event-management provider whose platform helps enterprises, small and medium-sized businesses and government bodies detect, anticipate and mitigate physical threats that affect people, places and property. The service combines risk intelligence, critical communications and incident-management tools, often powered by AI, so that organisations can remain operational during crises. Companies in this sector routinely process contact details, location data, emergency-response plans and other operational records that are sensitive both for privacy and for continuity of operations. A breach affecting such a provider therefore carries consequences that extend beyond the company itself to the many organisations that rely on its services for safety and crisis response.

What was likely exposed

The only data type named in the public record is “internal files exfiltrated in a ransomware attack.” Exact contents, file counts and any personal or regulated information remain unconfirmed. Organisations that deliver critical-event-management platforms typically hold employee and customer contact lists, incident logs, configuration data and, in some cases, location or health-related details used for emergency notification. Because those categories are characteristic of the sector rather than verified for this incident, it is not possible to state what was actually taken.

• Internal files (the sole category explicitly reported)
• Any personal identifiers, contact records or operational plans that may have resided among those files remain unconfirmed
• Scale of the exfiltration and number of affected individuals are unknown

Why it matters

When internal files leave an organisation that supports crisis communications, the practical risks are twofold. First, any personal data that may have been present can be used for phishing, identity fraud or further social-engineering attacks against the same individuals. Second, exposure of operational documents can reveal response procedures, contact trees or system configurations that adversaries might later exploit against OnSolve’s customers. For the organisation itself, the listing creates reputational pressure and potential contractual obligations to notify clients, even while the full scope stays unclear. Because the number of people affected is unknown, the circle of those who should remain vigilant is correspondingly broad.

Were you affected?

If you have an account, employment relationship or contractual link with OnSolve, treat the possibility of exposure as real until official clarification is issued. Practical first steps include monitoring financial and email accounts for unusual activity, enabling multi-factor authentication wherever available, and treating unsolicited messages that reference the incident with caution. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets. Continue to watch for any formal notification from OnSolve or from regulators; until such notice arrives, the precise impact on any individual remains unconfirmed.

AICompiled with AI assistance from public sources and published under our editorial standards.