rheem Listed by incransom Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
Rheem was listed by the Incransom ransomware group on April 20, 2026, after internal files were exfiltrated in a ransomware attack. An undisclosed number of people may have been affected; check your accounts and change passwords if you have been notified or suspect exposure.
What happened
The incident came to light through a listing on the incransom group's leak site on April 20, 2026. The entry names Rheem Manufacturing Company and asserts that internal files were taken. No further details on the timing of the intrusion, the method of access, the volume of data, or any ransom demand have been made public. The organisation has not issued a statement confirming or denying the claims.
The group behind it: incransom
Incransom is a ransomware operation that maintains a public leak site where it lists organisations it claims to have targeted. Like other groups of this type, it typically combines encryption of systems with the threat of releasing stolen files. The listing of Rheem constitutes the group's claim of involvement; independent confirmation of the data theft has not been reported.
Who is rheem?
Rheem Manufacturing Company is a long-established producer of heating, cooling and water-heating equipment. Founded in 1925 and headquartered in Atlanta, Georgia, the company supplies residential and commercial products including water heaters, boilers, air-conditioning units and HVAC systems. As a manufacturer with global operations, it maintains records related to customers, suppliers, employees and production processes.
What data was at risk
The only information released states that internal files were exfiltrated. The specific categories of data, file counts or whether personal information of customers or staff was included have not been disclosed. Organisations of this type routinely hold employee records, supplier contracts, product specifications and customer account details, but the exact contents of the claimed exfiltration remain unconfirmed.
The real-world impact
Exposure of internal files can create operational disruption for the company and may place individuals whose information appears in those files at risk of follow-on fraud or targeted scams. Without a confirmed inventory of the data, the scale of any personal impact cannot be quantified. The organisation faces the standard tasks of verifying the scope of access and notifying regulators or affected parties if required by applicable law.
Were you affected?
Individuals who have done business with Rheem or worked for the company can monitor official statements from the organisation for any future notifications. A practical first step is to review recent account statements and enable multi-factor authentication on any services that may share email addresses or other identifiers with the company. Readers can also run a free exposure scan of their email address against known breach data sets to check for prior appearances of their information.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
jasperplastics.info Listed by incransom Ransomware GroupKewaunee Scientific Listed by incransom Ransomware GroupPILLER AIMMCO Listed by incransom Ransomware Grouprbh aerospace inc Listed by incransom Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the rheem Listed by incransom Ransomware Group →
Publicly posted by incransom — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.