Incransom Claims 416 GB Data Leak at Mauritius Firm SpearFin
Summary
A ransomware.live monitoring post attributes a June 26, 2026, claim of a 416 GB data leak at Mauritius-based SpearFin Ltd to incransom. The post says the material includes KYC/AML records and financial and corporate documents; the claim is unconfirmed.
Key points
- The post attributes the data-leak claim to ransomware actor incransom and cites the actor’s leak-site disclosure.
- The named victim is SpearFin Ltd, a fund administration and corporate services provider in Mauritius.
- The post says the claimed leak occurred on June 26, 2026, and totals 416 GB.
- Claimed materials include KYC/AML records, passports, bank statements, shareholder and director registers, payroll records, and corporate agreements.
- The post says the material references multiple clients and was classified as confidential.
- The publisher says it cannot confirm the claim’s accuracy; full publication of the material was announced as forthcoming.
Article Details
- Victim
- SpearFin Ltd
- Victim Domain
- Not disclosed
- Attack Date
- 2026-06-26
- Encryption Status
- Unknown
- Exfiltration Status
- Claimed; the article attributes the data leak to incransom but says the information cannot be confirmed.
- Exfiltrated Data
- The claimed leaked material includes KYC/AML records, passports, bank statements, shareholder and directors registers, investment and corporate agreements, correspondence, payroll records, and other documents.
- Exfiltrated Size
- 416 GB claimed
- Ransom Demand
- Not disclosed
- Leak Status
- The group-attributed disclosure is reported, but its accuracy is unconfirmed. Full publication was announced as coming soon.