Softura Listed by incransom Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On April 23, 2024, Softura was listed on the leak site of the ransomware group known as incransom. The group claims to have exfiltrated more than 120 GB of internal files from the company and has threatened to publish the material if no agreement is reached. The number of people affected remains unknown, and public detail on the precise method and timing of the intrusion is limited.

The listing itself is an unverified claim by the attackers. What is known so far is that Softura, a software-engineering firm, has been named as a victim of a ransomware operation that combines encryption with data theft. For clients, employees and partners, the practical question is what information may have left the organisation and what steps can reduce further risk.

Breaking down the breach

According to the public listing, incransom asserts that it obtained more than 120 GB of Softura’s internal files during a ransomware attack. The group states that the entire dataset will be released unless an agreement is reached. No independent confirmation of the volume, the date of the intrusion, or the technical vector has been published in the available record. The number of individuals whose data may be involved is listed as unknown. Softura has not, in the facts provided, issued a detailed public statement confirming or denying the scale of the claim.

Ransomware incidents of this type typically involve initial access, lateral movement, data staging and exfiltration, followed by encryption of systems. None of those stages has been described in open sources for this specific case, so the operational timeline remains undisclosed.

Who is incransom?

Incransom is a ransomware operation that follows the now-common double-extortion model: systems are encrypted and a copy of stolen data is held as additional leverage. Groups using this model publish victim names on dedicated leak sites and set deadlines for payment, after which they threaten to release or auction the material. Public reporting on incransom has documented its use of standard ransomware tooling, affiliate-style recruitment of initial-access brokers, and pressure tactics that include staged data dumps. The group’s listing of Softura should be treated as a claim rather than verified fact; the existence of a leak-site entry does not by itself prove that every asserted file was taken or that negotiations have or have not occurred.

Who is Softura?

Softura is a software-engineering company that, according to the material posted by the attackers, has operated for more than 25 years, delivering projects with onshore and offshore teams. The same material notes ISO 27001 and CMMI Level 3 certifications and describes the firm’s ability to scale teams and supply specialised technical skills. Organisations of this type typically hold source code, project documentation, client contracts, employee records, and internal operational data. Because Softura works with external clients, a compromise can affect not only its own staff but also the intellectual property and business information of the companies it serves. A breach at a certified software-services provider therefore carries potential consequences for supply-chain trust and contractual obligations.

The information in question

The only data category named in the available facts is “internal files exfiltrated in a ransomware attack.” The attackers further claim possession of more than 120 GB of material. Exact file types, whether they include personal data, source code, credentials or client deliverables, have not been independently confirmed. Companies in Softura’s sector commonly store:

• employee and contractor personal information,
• client project files and source repositories,
• internal financial and operational documents,
• authentication and system-configuration data.

Until Softura or a forensic report publishes a verified inventory, any assertion about specific records remains unconfirmed.

Why it matters

For individuals whose details may appear in the stolen files, the concrete risks include targeted phishing, identity fraud and credential stuffing if usernames or passwords were present. For Softura’s clients, the exposure of project materials or proprietary code can create competitive and contractual harm. For the company itself, the incident raises questions of operational continuity, regulatory notification duties under data-protection regimes, and the cost of investigation and remediation. Because the volume of affected people is unknown and the precise contents are unverified, the full scope of harm cannot yet be quantified; the prudent course is to treat the claim as a credible threat until proven otherwise.

Were you affected?

If you are a current or former Softura employee, contractor or client, treat any unexpected communication that references the company with caution. Practical first steps include:

• changing passwords used for Softura-related accounts and enabling multi-factor authentication where available,
• monitoring financial and credit accounts for unusual activity,
• reviewing email filters and security logs for signs of targeted phishing,
• retaining any official notices Softura may issue so that you can follow its guidance on credit monitoring or identity-protection services.

Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach datasets. Public detail on this incident remains limited; further verified information from Softura or independent investigators will be needed before the full impact can be assessed.

AICompiled with AI assistance from public sources and published under our editorial standards.