TransCore ITS, LLC Listed by crypto24 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

For customers, partners and employees whose information may sit inside TransCore ITS systems, the appearance of the company on a ransomware leak site raises immediate, practical questions: whether personal or contractual details have left the organisation’s control, and what steps can reduce any resulting risk. Public reporting so far leaves the number of people affected unknown, yet the claims themselves are enough to warrant careful attention.

On 31 March 2025 TransCore ITS, LLC was listed by the ransomware group crypto24. The listing asserts that internal files were taken in a ransomware attack. Beyond that assertion, independent confirmation of scale, method or exact contents remains limited.

Inside the incident

According to the public listing dated 31 March 2025, crypto24 claims to have breached the internal network of TransCore’s Dubai office and to have exfiltrated more than 200 GB of internal data. The group states that the material includes in-development source code, full file sets from active and archived client projects, internal financial records, and a large volume of unprotected customer data. It further asserts that the stolen material contains clear violations of multiple non-disclosure agreements and exposes confidential third-party materials and client information. The number of people affected is listed as unknown. No independent verification of the volume, the precise files, or the technical method of intrusion has been published in the available record. The incident is therefore known only through the group’s own claim of a successful ransomware operation that combined network access with data exfiltration.

Inside crypto24

crypto24 is a ransomware operation that follows the now-familiar double-extortion model: encrypting systems while simultaneously copying data and threatening to publish it on a dedicated leak site if payment is not made. Public reporting on the group over recent years shows a pattern of targeting mid-sized and larger organisations across multiple sectors, posting victim names and sample file lists to pressure negotiation, and releasing larger archives when deadlines pass. The group typically claims responsibility for both the encryption event and the subsequent data theft. Its listings are therefore claims rather than independently audited facts; they serve as the group’s public pressure mechanism. In this case the listing of TransCore ITS is presented in exactly that form—an unverified assertion by crypto24 that it holds the described material.

TransCore ITS, LLC and its sector

TransCore ITS, LLC operates in the intelligent transportation systems sector, supplying technology and services that support traffic management, tolling, electronic payment and related infrastructure projects. Organisations of this type routinely hold detailed project documentation, source code for operational systems, contractual records with public and private clients, and customer or end-user data generated by those systems. Because many of the projects involve public infrastructure and multi-party contracts, the data sets often include commercially sensitive designs, financial terms and personally identifiable information belonging to drivers, account holders or partner staff. A breach that reaches such material can therefore affect not only the company itself but also the third parties whose information is stored under non-disclosure or data-processing agreements. The Dubai office referenced in the claim is one node in a broader operational footprint; any compromise there raises questions about the security of shared repositories and client deliverables.

What data was at risk

The only data types named in the public record are those asserted by crypto24: internal files exfiltrated in a ransomware attack, specifically in-development source code, complete file sets from active and archived client projects, internal financial records, and a large volume of unprotected customer data. The group further claims that the material includes confidential third-party content covered by non-disclosure agreements. No independent inventory has been released, and the precise number of individuals or organisations whose records appear in the cache remains undisclosed. Organisations in the intelligent-transportation sector typically retain project archives, system credentials, billing information and customer account details; whether any of those categories are present in the claimed 200 GB set cannot be confirmed from the available facts. Readers should therefore treat the listed categories as the group’s unverified description rather than as an audited catalogue.

Why it matters

If customer or partner records are among the files, individuals face the ordinary downstream risks of phishing, identity misuse or targeted fraud that follow any exposure of personal or financial data. For client organisations whose project files or source code may have been taken, the exposure can create contractual liability, competitive disadvantage and the need to rotate credentials or redesign systems that rely on the compromised material. TransCore itself faces potential regulatory scrutiny, contractual claims under non-disclosure agreements, and the operational cost of containment and notification. Because the number of affected people is unknown and the exact contents unconfirmed, the practical impact remains a range of possibilities rather than a fixed list of harms. The absence of public detail does not reduce the need for vigilance; it simply means that affected parties must act on the basis of the claim itself until fuller information appears.

Were you affected?

Anyone who has done business with TransCore ITS, held an account linked to its systems, or worked on projects that may have been stored in the Dubai office should treat the listing as a prompt for basic hygiene: monitor financial and account statements for unusual activity, enable multi-factor authentication where available, and be alert to unexpected messages that reference TransCore or related projects. If you receive notification from the company, follow the instructions it provides. As an additional check, you can run a free exposure scan of your email address to see whether that address has already appeared in known breach data sets. Early awareness remains the most reliable first step while official confirmation of the precise data set is still pending.

AICompiled with AI assistance from public sources and published under our editorial standards.