The INC Ransom extortion group has listed Audacie Inc., an accounting, audit and tax firm based in Brossard, Quebec, on its leak site. The group claims it took 1,375,622 files totalling 949.5GB, covering 21 years of client and internal records. According to the group, the files include audit working papers for companies listed on the Toronto Stock Exchange, tax returns containing Social Insurance Numbers (SINs), and the firm's own firewall configurations and password vault. Audacie has not publicly acknowledged an incident, and no regulator filing or breach notice has been published. The group's post says management was contacted and gave "no meaningful response." Every detail below comes from the attackers' own listing or from trackers and blogs repeating it. None of it has been independently verified.
What Happened
The listing first appeared on INC Ransom's leak site on 10 November 2026, according to the leak tracker RansomLook (as cited by Vulnpocalypse) and the leak-monitoring site cybercrime.works. DeXpose reported the claim on 12 November and QPulse followed on 13 November, which is why some reports give a later date.
The group's post describes Audacie as a firm of about 55 staff with roughly CA$6.6 million in revenue and three offices on Montreal's South Shore: Brossard, Sorel-Tracy and Saint-Jean-sur-Richelieu. The firm previously traded as Comptables Agréés Guimond Lavallée (CAGL). It offers accounting, audit, tax, consulting, governance and notarial services. The post claims the attackers took the firm's main file server, covering two shared drives (550.5GB and 399.1GB) plus staff home folders.
The group's statement doesn't say whether systems were encrypted. The listing focuses entirely on stolen data, which suggests the pressure on Audacie is the threat of publication.
What Was Taken
All of the following comes from the group's own description. Some of the figures don't add up, and the main ones are flagged below.
- Client records. QPulse and Persian Security both report that the group claims audit, tax and accounting files for about 1,855 business clients, roughly 908GB of the total. The leak post itself describes Audacie as an adviser to "nearly 4,000 clients."
- Personal tax returns and SINs. Both outlets cite about 110GB of personal tax returns with SINs for roughly 1,900 individuals. QPulse's analysis elsewhere puts the number of exposed SINs at 3,933. The claimed count therefore ranges from about 1,900 people to 3,933 SINs, and neither figure has been verified. The gap may come from returns listing more than one person, such as spouses or dependants, but no one has explained it.
- Audit files for TSX-listed companies. QPulse reports that the group claims non-public audit working papers and internal control documents for Goodfellow Inc., GURU Organic Energy Corp. and BTB REIT. Persian Security names the first two. None of these companies has commented.
- IT and security material. About 11GB, according to Persian Security, including:
- a KeePass password vault
- full configurations for FortiGate firewalls at all three offices, including VPN rules and user lists
- Active Directory exports and network maps
- admin access to the Grandstream phone system
- SMTP relay passwords
- Saved browser passwords. QPulse reports 88 plaintext username and password pairs from an exported Chrome password file. These reportedly include logins for the Canadian government's GCKey service and Quebec's clicSÉQUR portal.
- HR and payroll. Persian Security reports that profiles and pay details for all 55 employees are included.
The category sizes reported by QPulse and Persian Security add up to more than the 949.5GB total the group gives, so at least some of these figures are wrong or overlap. Persian Security also says a former Montreal politician's personal data is in the set. No other report repeats that claim, and it hasn't been verified.
Why It Matters
Exposure for audited listed companies. An auditor holds unpublished financial results, control weaknesses and judgements about its clients. If audit files for TSX-listed companies are genuine and get leaked or sold, they could be used for insider trading or targeted fraud. The companies' audit committees and securities regulators may also need to get involved.
Identity fraud and government accounts. SINs combined with full tax returns give fraudsters what they need to impersonate someone, including filing fake tax refunds and opening credit. The claimed GCKey and clicSÉQUR logins matter because tax firms use those portals to act on clients' behalf with federal and Quebec tax authorities. If the claim is accurate, those logins would give access to client tax accounts, not just to documents.
Possible ongoing access. QPulse warns that firewall configurations, VPN user lists and a password vault could let the attackers, or anyone who buys the data, get back into Audacie's network and possibly reach client systems through trusted connections. That risk stays until every credential is rotated, whatever happens with the leak.
Notification duties. If the SIN claims hold up, Audacie would likely have to notify Quebec's privacy regulator, the Commission d'accès à l'information, and the affected people under Quebec's Law 25. No such notice has appeared.
Group activity. SOCRadar says INC Ransom has claimed about 50 victims in 60 days, mostly in the United States, Brazil and Spain, and focuses on professional services and law firms because their client data gives strong leverage in negotiations. On the same day DeXpose reported the Audacie claim, it also reported an INC Ransom claim against Ontario law firm Pomer & Boccia Professional. QPulse separately reports a claim against Czech financial advisory firm Partners Financial Services involving Active Directory, backup systems and client call recordings. The group appears to be targeting firms that hold large amounts of client data in regulated sectors.
The Attack Technique
How the attackers got in has not been disclosed, and the group's post doesn't say.
The data described points to wide internal access. The group claims domain controllers, the FortiClient endpoint management server, the main file server and the firewall at each office. The leak post lists all three FortiGate units as running firmware from the 7.2 and 7.4 branches. Nothing shows a firewall was the way in, but internet-facing VPN appliances are a common target for ransomware groups. Any firm running FortiGate SSL-VPN should check its patch level regardless.
In a separate INC Ransom case, SOCRadar found 25 infostealer log records tied to the victim's corporate email accounts. It describes stolen sessions and passwords from infostealer malware as a standard way for the group's affiliates to get past perimeter defences. The plaintext Chrome password export in the Audacie claim fits the same kind of credential-heavy access, but that link is a guess, not a finding.
What Organizations Should Do
- Clients of Audacie: Contact the firm directly through a channel you already know is genuine. Ask whether your files were in scope. Treat unexpected emails that mention Audacie, invoices or tax matters as possible phishing.
- Individuals whose returns Audacie prepared: Turn on CRA and Revenu Québec account alerts, review recent account changes and authorised representatives, and consider credit monitoring with Equifax and TransUnion Canada.
- Companies with Audacie audit relationships: Brief your audit committee and legal counsel now. Review whether any representative or delegated access Audacie holds to your systems, banking or government portals should be removed or re-issued.
- Accounting and law firms generally:
- Ban browser password storage on staff machines.
- Require a managed password manager with multi-factor authentication.
- Scan for infostealer exposure of corporate email accounts.
- Anyone running FortiGate or FortiClient EMS:
- Apply the latest firmware.
- Audit VPN user lists for stale accounts.
- Require multi-factor authentication on all remote access.
- Treat firewall configuration backups as secrets.
- Prepare for credential theft: If a password vault or Active Directory export is taken, rotate every credential it held, including service accounts, plan a double reset of the Kerberos krbtgt account, and look for new VPN accounts or firewall rules that someone else created.
Sources: Incransom Group Exfiltrates 949GB of Data from Audacie Inc. Includi... | Incransom Attacks Audacie Inc. in Massive Ransomware Breach - DeXpose | نشت عظیم ۹۵۰ گیگابایت دادههای حساس و اطلاعات مالی شرکت Audacie توس... | Incransom Strikes Pomer & Boccia Professional - DeXpose | Incransom Group Exfiltrates Active Directory Forest and 1.3 Million... | BPCM Data Breach - SOCRadar | audacie.com — Audacie Inc. — incransom | Inc ransom claims Audacie Inc. on leak site Vulnpocalypse