Selex - Gruppo Commerciale Listed by incransom Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On April 27, 2026, Selex Group confirmed that it had been the target of a cyber attack in recent days. The company stated that the incident involved the exfiltration of approximately one terabyte of data, including production and development sources as well as personal and financial information belonging to employees, customers, and partners. The number of individuals affected remains unknown. The listing of Selex Group on a site associated with the incransom ransomware group has drawn attention to the event, though the precise scope of any public exposure of the material is not confirmed.

Inside the incident

Selex Group announced the breach on April 27, 2026, describing a ransomware attack that took place in the preceding days. The organisation reported that roughly one terabyte of data had been taken, encompassing both operational systems and material described as sensitive. No further details on the method of intrusion or the duration of unauthorised access have been made public.

The number of people whose information was involved is not stated. The company characterised the affected material as including production and development sources along with personal and financial records of employees, customers, and partners.

Who is incransom?

Incransom is a ransomware group that has appeared in multiple public listings of compromised organisations. Such groups commonly gain access through remote services or phishing, encrypt systems, and exfiltrate data before demanding payment. Their public claims of responsibility are presented on dedicated sites and are not independently verified in every case.

In this instance the group lists Selex Group on its site. The listing constitutes the group’s assertion that it holds material from the organisation; Selex Group has separately confirmed that a data breach occurred.

Who is Selex Group?

Selex Group operates as a grocery retailer and distributor in Italy. Organisations of this type routinely maintain records related to supply chains, inventory systems, customer transactions, and employee administration. A compromise at such a firm can therefore touch both commercial operations and the personal details of large numbers of individuals who interact with the business.

The information in question

The company has stated that internal files were taken, including production and development sources as well as personal and financial information of employees, customers, and partners. The exact categories and volume of records beyond the reported one-terabyte figure have not been itemised publicly.

What's at stake

Individuals whose data appear in the exfiltrated material may face risks of identity misuse or targeted fraud, depending on the specific fields involved. For the organisation, the incident adds operational disruption and potential regulatory obligations under Italian and European data-protection rules.

Were you affected?

Selex Group has not published a list of affected individuals. People who have shopped at Selex stores or worked with the company can take the following steps while further details remain limited:

• Monitor bank and credit-card statements for unusual activity.
• Enable multi-factor authentication on any accounts linked to the retailer.
• Review privacy settings on loyalty or customer accounts.
• Run a free exposure scan of their email address against known breach data sets.

AICompiled with AI assistance from public sources and published under our editorial standards.