The INC Ransom extortion group (also tracked as "Incransom") has listed Thai pharmaceutical manufacturer Millimed Co., Ltd. on its leak site. The group says it stole more than 3 terabytes of data, including drug manufacturing records, regulatory submissions, financial statements and employee biometric data. At the time of writing the claim has not been independently verified. Millimed has made no public statement, and no notification to Thailand's Personal Data Protection Committee (PDPC) has been made public. Everything below about the scope of the breach comes from the attackers, as relayed by threat-tracking services. Treat it as a claim, not an established fact.
What Happened
QPulse, a threat-intelligence feed, reports that the group announced the breach on 17 September 2026. The group claims it had "complete access" to Millimed's IT infrastructure, including production plants in Samut Prakan and Chiang Rai and the Bangkok headquarters, and says the data spans 25 subsidiary companies.
The timeline is unclear. Vulnpocalypse, citing the ransomware tracker RansomLook, reports a leak-site listing for "Millimed Thailand (i-HERB)" dated 10 November 2026. i-HERB appears to be a brand associated with the company. Vulnpocalypse notes it could only review the RansomLook headline, and that it found no independent verification and no other outlet covering the story. The gap between a September announcement and a November listing could mean the group posted the victim twice, which leak sites often do when negotiations stall. It could also be a dating error in one of the reports. The public record does not settle which.
Millimed is one of at least two Thai organisations the group listed around the same time. On 10 November INC Ransom also posted Hong Bao Group, a Bangkok restaurant group with more than 15 brands. That listing claims more than 736,000 files taken from a file server, a NAS device and an SAP Business One SQL Server, according to the leak-site mirror cybercrime.works and QPulse. Separately, the Krybit group listed Thai medical product distributor Orex Trading on 1 September 2026, claiming 194.49 GB of data, Siberpol reports. Nothing links the Krybit incident to INC Ransom.
What Was Taken
QPulse relays the group's claimed contents:
- Pharmaceutical IP and regulatory files: Batch Manufacturing Records from 2016 to August 2026, quality control databases, drug registration documents and bioequivalence study reports.
- Financial records: audited statements, loan covenants and monthly sales reports covering 2024 to 2026.
- Employee data: names, national ID numbers, salaries and biometric data for more than 1,000 people.
- Administrative credentials: for Oracle ERP, SQL Server, Microsoft 365 and Thai government portals including the Revenue Department and the Board of Investment.
- Physical security configuration: CCTV and access control system settings.
No independent party has published samples or confirmed any of these categories. The 3TB figure is the group's own. Ransomware groups have a commercial reason to inflate both volume and sensitivity.
Why It Matters
If the claim is accurate, this goes well beyond a routine data leak, for three reasons.
First, batch records, quality control data and bioequivalence studies are core regulatory and commercial assets for a drug maker. Exposing them could help competitors or counterfeiters, and could complicate the company's dealings with Thailand's Food and Drug Administration.
Second, the claimed credentials matter more than the files. Admin access to ERP, Microsoft 365, tax and investment-board portals gives an attacker a route to invoice fraud, false tax filings or a second intrusion, long after the original data dump. Biometric data cannot be reset the way a password can.
Third, the regulatory clock. Under Section 37(4) of Thailand's Personal Data Protection Act B.E. 2562 (2019), a data controller must notify the PDPC Office within 72 hours of becoming aware of a breach, unless the breach poses no risk to people's rights and freedoms, according to legal guidance from AIPDPA. Where the risk is high, the people affected must also be told. Biometric and national ID data from more than 1,000 employees would almost certainly meet that bar. Notification can be delayed for necessary reasons, but it must still be made within 15 days.
More broadly, SOCRadar reports that INC Ransom has claimed around 50 victims in the past 60 days, mostly in the United States, Brazil and Spain, with a focus on professional services and legal firms. Two Thai listings within weeks of each other suggest the group, or at least one of its affiliates, is now working in Thailand.
The Attack Technique
How the attackers got into Millimed is not known. Neither the company nor any investigator has said, and the leak-site claims do not describe an entry point.
Other cases offer some context, but none of it is evidence about this one. In INC Ransom's listing of US agency BPCM, SOCRadar found 25 infostealer log records tied to corporate accounts, including at least one compromised managed workstation. SOCRadar notes that infostealer logs are a standard way for ransomware affiliates to get past perimeter defences. In the Hong Bao listing, QPulse notes the attackers reported finding CLR assemblies already loaded in the victim's SQL Server, which suggests an earlier compromise. That points to database servers as a target worth checking in Thai mid-market environments.
The group's claim of control over "entire infrastructure" across several sites matches a wider pattern of attackers going after the management layer. Kaspersky's Global Emergency Response Team recently documented a separate case involving the BlackNevas group, which is not linked to INC Ransom. In that case the attacker took over vCenter through Active Directory integration, reused Windows credentials and used backup infrastructure as a bridge. Over 10 days it destroyed four ESXi hosts, both vCenter appliances and all connected backups. Whether anything similar happened at Millimed is unknown.
What Organizations Should Do
- Hunt for infostealer exposure. Check commercial and open infostealer log feeds for your corporate domains. Force password resets and revoke sessions for any account that appears, especially Microsoft 365, ERP and VPN accounts.
- Rotate privileged and government-portal credentials. Tax, investment-board and banking portal logins are often shared and rarely rotated. Put them in a vault, enforce MFA where the portal supports it, and change them now if you share suppliers or IT providers with the affected firms.
- Audit database servers. Look for unexpected CLR assemblies, new sysadmin accounts and unusual large exports on SQL Server and ERP back-ends. In both Thai INC Ransom listings, the attackers claim to have taken those systems.
- Treat virtualization and backup as Tier 0. Separate vCenter and ESXi admin identities from ordinary domain admin accounts. Restrict direct host management, send logs to a system the attacker cannot reach, and keep at least one backup copy offline or immutable, on credentials not tied to Active Directory.
- Separate physical security systems from the network. CCTV and access control controllers should sit on isolated network segments with their own credentials, not on the corporate domain.
- Prepare your PDPC response before you need it. Thai data controllers should have a 72-hour notification workflow ready, including the PDPC Office's electronic channel ([email protected]) and a decision process for when to notify affected people directly. Make sure processor contracts require your vendors to notify you within 72 hours.
Partners, suppliers and employees of Millimed should be wary of unexpected emails, calls or payment-change requests that mention the incident. Verify them through a contact point you already trust.
Sources: Incransom Group Exfiltrates 3TB of Data from Millimed Thailand, Exp... | ESXi ransomware: why it is dangerous and how to defend against it... | Inc ransom claims Millimed Thailand (i-HERB) attack Vulnpocalypse | HONG BAO GROUP (lovelywines.co.th) — incransom | Incransom Ransomware Group Exfiltrates 736,000+ Files from Thai Res... | krybit ransomware group lists orex.co.th on its leak site | BPCM Data Breach - SOCRadar | Data breach in Thailand? Report to the PDPC in 72 hours