proton-system_Serbia Listed by incransom Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Breaking down the breach

The incident was reported on 3 January 2026 through a listing attributed to the Incransom group. The organization affected is identified as proton-system_Serbia, operating at www.proton.rs. Public records indicate that internal files were exfiltrated. No confirmed count of records, files, or individuals has been released. The group states that it attempted to negotiate with the organization’s management and claims the company was unresponsive. It further states that more than 130 GB of personal data could be published if negotiations do not continue within two days. These statements originate from the group’s listing and have not been independently verified.

Who is incransom?

Incransom is a ransomware operator that conducts double-extortion attacks: it encrypts systems and removes copies of data, then demands payment to prevent publication. The group maintains a leak site where it lists organizations that have not met its demands. Such listings serve as a pressure tactic and constitute the group’s claim that data from the listed victim is in its possession. Incransom has appeared in public reporting on ransomware activity in multiple countries, following patterns common to other extortion-focused groups that combine encryption with data theft.

proton-system_Serbia and its sector

Proton System operates in Serbia and maintains the domain www.proton.rs. Public business directories describe it as a company active in systems-related services, though detailed information on its size, client base, or specific operations is limited. Organizations in this sector commonly process internal records that can include employee information, customer details, and operational documents. A breach at such an entity is consequential because the data may relate to individuals who have limited visibility into how their information is stored or protected.

The information in question

The only data category explicitly named in available reports is internal files exfiltrated during a ransomware attack. The group’s listing refers to “personal data” within a claimed volume of more than 130 GB, but no verified inventory of file types or record categories has been published. Public detail on the exact contents therefore remains limited. Organizations of this type typically hold employee records, customer contact information, and business correspondence; however, whether any of these categories are present in the exfiltrated material is unconfirmed.

The real-world impact

People whose information appears in the exfiltrated files could encounter risks such as misuse of personal identifiers or targeted attempts at fraud. The organization may face operational disruption, legal inquiries, or loss of trust from clients and staff. Because the number of affected individuals and the specific data fields are not known, the scale of these consequences cannot be quantified from currently available information.

What to do if you're exposed

Anyone who has interacted with Proton System or believes their information may be involved should begin with basic protective measures. These steps reduce immediate risks even when the full scope of exposure is still unclear.

• Monitor bank and credit accounts for unusual activity and enable transaction alerts.
• Change passwords for any accounts linked to the organization and avoid reusing those passwords elsewhere.
• Request a credit report from available national services to check for unauthorized applications.
• Run a free exposure scan of your email address against known breach datasets to determine whether your information has appeared in other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.