VZW Avalon Listed by incransom Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

VZW Avalon has been listed by the ransomware group known as incransom, according to a report dated October 31, 2025. The listing claims that internal files were exfiltrated in a ransomware attack, with a reported volume of 38,554 files totaling 31,312,417,174 bytes. The number of people affected remains unknown, and public detail on the incident is limited to these claims from the group’s leak site.

This matters because organizations of this type often hold operational records and personal information belonging to staff, members, or service users. When a ransomware group asserts it has taken internal files, those claims require careful scrutiny even when independent confirmation is not yet available.

Breaking down the breach

The available facts state that VZW Avalon was listed by incransom on or around October 31, 2025. The group claims that internal files were exfiltrated during a ransomware attack. The reported summary lists 38,554 files amounting to 31,312,417,174 bytes. No further public detail has been provided on the precise timing of the intrusion, the initial access method, the duration of the attackers’ presence, or whether any ransom demand was made or paid. The number of individuals whose data may be involved is listed as unknown. These figures and the description of “internal files” originate from the group’s own listing and have not been independently verified in the material available.

The group behind it: incransom

Incransom is a ransomware operation that follows the double-extortion model common among modern ransomware groups. After encrypting systems, such groups typically claim to have stolen data and threaten to publish it on a dedicated leak site if payment is not received. They often advertise victims with file counts and data volumes to pressure organizations into negotiating. Public reporting on incransom has documented this pattern of leak-site postings across multiple sectors. In the present case, the listing of VZW Avalon should be treated as an unverified claim by the group rather than confirmed fact. No additional statements attributed specifically to this incident beyond the file count and byte total have been provided in the available record.

Who is VZW Avalon?

VZW Avalon is a Belgian non-profit association (VZW denotes a vereniging zonder winstoogmerk). Organizations of this form typically operate in social, care, educational, cultural, or community-support fields and maintain records related to their members, staff, volunteers, clients, or beneficiaries. Such entities commonly process contact details, administrative correspondence, financial or membership records, and operational documents. A ransomware incident affecting a non-profit can disrupt services, expose sensitive personal or operational information, and create lasting administrative and reputational consequences. Because the exact nature of Avalon’s activities is not detailed in the breach report, the potential impact must be assessed in general terms for organizations of this type.

The information in question

The facts name the exposed material only as “internal files exfiltrated in ransomware attack,” accompanied by the quantitative claim of 38,554 files totaling roughly 31.3 gigabytes. No further breakdown of file types, document categories, or personal data elements has been disclosed. Organizations comparable to VZW Avalon commonly hold staff and volunteer records, membership or client lists, correspondence, financial documentation, and internal operational files. Whether any of those categories were among the claimed files remains unconfirmed. The exact contents of the exfiltrated material are therefore unknown, and no specific personal data fields can be stated as fact.

Why it matters

For individuals whose information may have been among the internal files, the primary risks include unauthorized use of personal details for phishing, identity fraud, or social-engineering attempts. Even limited administrative data can be combined with other sources to increase the credibility of subsequent scams. For the organization itself, the consequences can include operational disruption, the need to notify regulators and affected parties under applicable data-protection rules, potential legal and financial costs, and erosion of trust among members or service users. Because the scale of personal impact is listed as unknown and the precise data types remain undisclosed, the full extent of harm cannot yet be measured. The mere claim of a large volume of internal files is sufficient to warrant caution and monitoring by anyone connected to the organization.

If your data was in this claimed breach

If you have a connection to VZW Avalon—as staff, volunteer, member, or service user—treat the possibility of exposure seriously until more information emerges. Practical first steps include:

• Monitor financial and email accounts for unexpected activity or password-reset attempts.
• Enable multi-factor authentication on important accounts where it is not already active.
• Be alert to phishing messages that reference the organization or claim to offer help related to a data incident.
• Consider changing passwords for any accounts that may have shared credentials with organizational systems.
• Run a free exposure scan of your email address to check whether your information has already appeared in known breach data sets.

Public detail on this incident remains limited to the group’s listing. Further official statements from VZW Avalon or independent confirmation would be required before the full scope can be established. In the meantime, the measures above reduce the most immediate practical risks.

AICompiled with AI assistance from public sources and published under our editorial standards.