On April 28, 2026, the Incransom ransomware group claimed responsibility for a significant intrusion against Sumac Inc. (sumacinc.com), a USA-based technology firm. The attackers have allegedly exfiltrated 2TB of sensitive client data and are threatening public release unless extortion demands are met. The claim was published on Incransom's leak infrastructure and surfaced via DeXpose threat intelligence reporting.

What Happened

Incransom listed Sumac Inc. as a victim on its data leak site, asserting possession of "all client data 2tb." The posting follows the group's standard double-extortion playbook: encrypt operational systems, exfiltrate sensitive datasets, and pressure the victim with a public countdown to leak. As of publication, Sumac Inc. has not issued a formal statement, and there is no public indication of whether negotiations are underway or whether systems have been restored. The disclosure timing, one day after the alleged compromise, suggests Incransom is moving quickly to maximize coercive leverage.

What Was Taken

According to the threat actor's own claim, the stolen archive totals approximately 2 terabytes and is described as "all client data." For a technology vendor, that classification typically encompasses customer records, contractual documentation, project artifacts, support tickets, internal communications, and potentially credentials or API keys embedded in client environments. The volume is consistent with sustained access over a window long enough to stage and exfiltrate large datasets, indicating the intrusion was not a smash-and-grab but a deliberate, dwell-time operation.

Why It Matters

A breach at a technology provider rarely stops at the provider's perimeter. Sumac Inc.'s downstream clients now face the prospect of secondary exposure: leaked configurations, embedded credentials, and proprietary data flowing into criminal markets where infostealer brokers and initial access brokers can repurpose them for follow-on intrusions. Incransom has demonstrated a pattern of following through on leaks when ransom demands are refused, meaning the 2TB threat should be treated as credible. Organizations with vendor relationships to Sumac Inc. should assume third-party exposure until proven otherwise.

The Attack Technique

Incransom has not disclosed its initial access vector for this incident. Historically, the group has relied on a combination of stolen credentials sourced from infostealer logs, exploitation of unpatched edge devices (VPN appliances, firewalls, and remote access gateways), and phishing to gain a foothold. Once inside, operators typically escalate privileges via credential dumping, move laterally through Active Directory, disable endpoint protection, and stage data on internal hosts before exfiltration over cloud storage or attacker-controlled infrastructure. Encryption of production systems usually follows exfiltration to maximize leverage.

What Organizations Should Do

Sources: Incransom Strikes Sumac Inc. in Major Ransomware Attack - DeXpose