On February 15, 2026, the ransomware group IncRansom added acwapower.com and https://www.larsentoubro.com/ to its leak site and published proof that it had exfiltrated 400 GB of internal files from what appears to be a shared infrastructure or supply-chain relationship between the two organizations.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Watch acwapower.com \ https
Get alerted the next time acwapower.com \ https files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about acwapower.com \ https’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
What Public Reporting Shows
Public reporting on the IncRansom leak site describes a ransomware incident in which attackers gained access, encrypted systems, and exfiltrated roughly 400 GB of internal documents before publishing a sample on their onion blog. The listing names both Acwa Power, a Saudi-based power and water desalination company, and Larsen & Toubro, the Indian multinational known for engineering and construction projects. No exact victim count has been released; the exposed material consists of internal files rather than a structured database of customer records. Available reporting does not yet detail the precise initial access method or the specific types of data inside the 400 GB archive.
Why This Matters for You and Your Family
When suppliers and contractors in critical infrastructure sectors suffer breaches, the ripple effects frequently reach ordinary people. Contracts, employee rosters, vendor lists, project schedules, and correspondence can contain home addresses, personal phone numbers, email accounts, and sometimes family member details. Once those records leave the company’s control, they become raw material for identity thieves, phishing campaigns, and harassment. Even if your name is not on the headline list, a single spreadsheet that links your utility account, your contractor’s billing address, and your children’s school schedule can be enough to start a personalized attack.
Credential leaks from incidents like this one often cascade far beyond the original victim. Passwords or shared credentials reused across personal accounts turn a corporate breach into a direct threat to your banking, email, and social media profiles.