selp Listed by incransom Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On December 28, 2025, the ransomware group incransom listed the organization selp on its leak site and claimed to have taken internal files. The number of people whose information may be involved is not known, and no independent confirmation of the data’s contents or volume has been made public. For clients and partners of selp, the incident raises the possibility that business records and related personal or operational details could circulate beyond the company’s control.

Breaking down the breach

The only confirmed public detail is the listing itself on December 28, 2025. The group states that internal files were removed during a ransomware attack. No information has been released about when the intrusion began, how long the attackers had access, or the method used to enter the network. The scale of the operation, measured either in file count or in the number of individuals affected, remains undisclosed.

Who is incransom?

Incransom is a ransomware operator that follows the common pattern of encrypting victim systems and then posting claims of stolen data on a dedicated leak site. Groups of this type typically seek payment in exchange for not releasing the material and sometimes for providing a decryption key. Their public listings serve as pressure on the targeted organization; however, the accuracy of any specific claim made on such a site is not independently verified unless the victim or law enforcement later confirms it.

About selp

Selp is a French organization operating under the domain selp.fr. Its client list includes large international companies such as Apple, L’Oréal, Google, and IKEA. Entities that maintain relationships with multiple major corporations routinely receive and store documents covered by nondisclosure agreements, operational records, and technical materials. A breach at such an organization can therefore touch information belonging to several separate businesses and their employees or contractors.

What was likely exposed

The available facts state only that internal files were exfiltrated. The listing attributes to the incident a range of material described as confidential documents, client data, NDAs, financial data, operations records, corporate data, business agreements, and source code. Because these descriptions originate solely from the claiming party and no sample or inventory has been independently examined, the precise categories and sensitivity levels of any released information remain unconfirmed.

Why it matters

Business agreements and client-related records can contain details that affect commercial relationships, pricing structures, or project timelines. When such material leaves the original environment, the organizations named in the documents lose control over its further distribution. Individuals whose names, contact information, or professional activities appear in the files may face secondary risks such as targeted phishing or unwanted attention, even if no direct personal identifiers have been confirmed as present.

If your data was in this claimed breach

Begin by watching for unusual account activity and consider changing passwords for any services connected to selp or its known clients. Enable or review multi-factor authentication on those accounts. Organizations that believe they may be referenced in the material should follow their own incident-response procedures and consult legal counsel regarding notification obligations. Individuals can run a free exposure scan of their email address against known breach data sets to check whether their information has appeared in previously published collections.

AICompiled with AI assistance from public sources and published under our editorial standards.