The INC Ransom group (tracked by some as "Incransom") added Beaver County, Pennsylvania, to its data leak site on November 12, 2026. The group claims it stole sensitive data from the county government and says it will publish that data unless its demands are met. The only report of the listing so far comes from the dark web monitoring firm DeXpose. It gives the victim domain as beavercountypa.gov but includes no data volume, no file samples and no ransom figure. Beaver County has not commented in public. No state regulator filing or breach notice has appeared, and no security outlet has independently confirmed the intrusion. Treat this as an unverified claim by a criminal group until the county or investigators say otherwise.
What Happened
DeXpose reports that INC Ransom posted Beaver County to its leak site on November 12, 2026. It quotes the group as saying: "We have accessed sensitive data from Beaver County and will release it unless our demands are met." The listing as described does not say when the intrusion happened, whether systems were encrypted, or whether county services have been disrupted. The county has not reported any outages, and DeXpose's write-up does not mention any.
Don't confuse this incident with a different one. Siberpol reported that the Interlock ransomware group listed the Community College of Beaver County on its leak site, with an announcement date of April 3, 2026. That is a separate institution and a separate group, and nothing seen so far links the two incidents. This listing names the county government.
INC Ransom has targeted Pennsylvania organisations before. Siberpol notes that the group listed BerksBar.org, the Berks County Bar Association's site, in March 2025. Its posting there included screenshots of administrative documents and file directories as proof of access. The county attack also fits a wider pattern of Pennsylvania counties being hit. Union County, Pa., detected ransomware on its network on March 13, 2025. According to The Daily Item, reporting via GovTech, that breach exposed Social Security numbers and driver's licence numbers of people connected to county law enforcement and court matters. The Union County reporting does not name the group responsible, and nothing ties that incident to INC.
What Was Taken
Nothing has been confirmed. INC Ransom claims to hold "sensitive data" but, as far as public reporting shows, has not said what kind or how much, and has not posted sample files. No record count is available from any party.
What a county government typically holds gives a sense of the possible exposure. That includes court and law enforcement records, property and tax files, employee HR and payroll data, and personal data from social services and health programmes. The Union County breach shows what can come out of a Pennsylvania county network: Social Security numbers, driver's licence numbers and data tied to court matters. That county is still dealing with HIPAA-related corrective steps recommended by the U.S. Department of Health and Human Services' Office for Civil Rights more than a year after the attack.
If Beaver County confirms that personal information was taken, Pennsylvania's Breach of Personal Information Notification Act will set the timeline for disclosure. ClearIT's summary of the law says affected residents must be notified "without unreasonable delay," with no fixed number of days. Since September 26, 2024, any breach requiring notice to more than 500 Pennsylvanians must also be reported to the Office of Attorney General at the same time. Notice above that size also goes to the national credit bureaus. A filing with the Attorney General's office would be the first official sign of how large the breach is.
Why It Matters
INC Ransom is one of the more active ransomware operations hitting U.S. public bodies, and recent research shows its operators are working at greater scale.
In October 2026, the Atos Threat Research Center reported finding a misconfigured server tied to an operator in the INC ransomware ecosystem. The server exposed command-and-control components, exfiltration tools, "proof-of-compromise" packages built to pressure victims, victim management records, and an AI-assisted attack platform called "Phantom." Atos says the platform used OpenCode as the operator interface and WormGPT as the AI assistant. A 1,882-record operations log on the server documented targets, access methods, ransomware workflows and negotiations. SOC Prime's analysis of the same activity links the Phantom framework to affiliates of both INC and The Gentlemen ransomware groups. It says the investigation started from an exposed C2 server at 45.227.254.43 and led to six more servers controlled by the attackers. In the workflow both firms describe, AI does much of the technical work and humans supervise. That means fewer skilled operators can run more intrusions at once.
Atos also notes the shift towards data theft and extortion rather than encryption. For a county, that means restoring from backups does not end the incident. The data may already be gone, and the threat to leak it is the leverage.
The Attack Technique
Nobody has said how attackers got into Beaver County's network. The county has not disclosed it, and the leak site listing does not say. Recent reporting on INC operations points to several likely entry points.
Palo Alto GlobalProtect (CVE-2026-0257). Wafninja, citing Palo Alto Networks' Unit 42, reports that INC (which Unit 42 tracks as Tarnished Scorpius) and Qilin are exploiting CVE-2026-0257. The flaw is an authentication bypass in the GlobalProtect portal and gateway on PAN-OS firewalls and Prisma Access. It lets unauthenticated attackers get past MFA and open VPN sessions. Palo Alto disclosed the flaw on May 13, 2026, and CISA added it to the Known Exploited Vulnerabilities catalog after exploitation was confirmed. Unit 42 says it has worked intrusions tied to the bug since early June, including in government. Once inside, the attackers reportedly run reconnaissance with Cobalt Strike, BloodHound and SharpHound, move laterally over RDP and SMB, then go after vCenter and virtual disks before stealing data and deploying ransomware.
Other edge and remote access systems. SOC Prime names FortiClient EMS, SimpleHelp and cPanel as common ways in for the Phantom-linked affiliates. It also reports that they tamper with EDR, load known vulnerable drivers, persist through scheduled tasks, and use reverse SOCKS tunnels for command and control.
None of these methods has been tied to Beaver County specifically.
What Organizations Should Do
- Patch and check GlobalProtect now. Confirm every PAN-OS and Prisma Access deployment has the fix for CVE-2026-0257. Then look back for unexpected VPN sessions and logins to the local admin account from mid-May 2026 onward. Systems patched late may already have been breached.
- Lock down every remote access tool. Patch FortiClient EMS, SimpleHelp, cPanel and any RMM tooling. Audit their admin accounts for additions you didn't make. Require MFA, but don't treat it as enough on its own when a gateway flaw can bypass it.
- Protect the hypervisor layer. Separate vCenter and ESXi management from user networks. Require separate admin credentials, and alert on unusual access to virtual disks or snapshots.
- Hunt for INC-linked activity. Block and search logs for 45.227.254.43. Review scheduled tasks, changes to registry autostart locations, reverse SOCKS tunnels, and any stopped security services or newly loaded vulnerable drivers. Turn on EDR tamper protection.
- Plan for data theft, not just encryption. Watch outbound traffic for bulk transfers. Keep immutable offline backups, and know in advance which data sets would trigger notification under Pennsylvania law, including the concurrent Attorney General notice above 500 residents.
- Pennsylvania counties and nearby public bodies: expect phishing and fraud using the Beaver County name if data is published. Share indicators through CISA and the MS-ISAC.
Sources: Incransom Strikes Beaver County PA - DeXpose | Community College of Beaver County targeted by Interlock ransomware... | BerksBar.org listed on Inc Ransom leak site | Union County, Pa., Revises Jobs After Cyber Attack | Pennsylvania Data Breach Notification Law: 2024 Changes | Inside INC ransomware: Behind AI-Driven operations Atos AI | Qilin and INC Ransomware Have Spent Months Inside a Patched Palo Al... | INC and The Gentlemen Ransomware Use AI Infrastructure