American Pools & Spas Listed by INC Ransom Ransomware Group

On December 1, 2025, the ransomware group Incransom added American Pools & Spas, a pool construction and renovation company based in Orlando, Florida, to its public leak site and claimed to hold 500GB of the firm’s internal files, including fiscal data, internal emails, budgets, and other business records.

Reported Details of the Incident

Public reporting indicates that Incransom exfiltrated the data during a ransomware attack on the company. The group posted a notice on its leak site stating it possesses the 500GB archive and has begun publishing samples. No customer records or payment-card details have been explicitly listed in the initial disclosure, but the volume and type of material suggest a broad compromise of the company’s internal systems. The exact number of people whose personal information appears in the files remains unknown at this time.

Available reporting describes the posting as part of Incransom’s standard double-extortion tactic: first encrypting systems, then threatening to release stolen data unless a ransom is paid. The leak site entry carries today’s date, claiming the public phase of the incident began on December 1, 2025.

Why This Matters for You and Your Family

When a local business like your neighborhood pool company suffers a breach, the information exposed often includes names, addresses, phone numbers, email accounts, and sometimes Social Security numbers of customers, vendors, and employees. If you or anyone in your family has done business with American Pools & Spas in the past several years, your details could now sit inside that 500GB archive. Once criminals obtain such data, they rarely limit themselves to one target.

Internal emails and budgets frequently contain spreadsheets that list customer contacts side-by-side with project details. Those records can be sold on underground forums or used to launch convincing spear-phishing campaigns that appear to come from a company you already trust. For families, this raises the risk of identity theft, unauthorized account openings, and harassing phone calls or emails aimed at both adults and children whose names appear in family project files.

The Doxxing and Identity-Chain Implications

A single breach rarely stops at the original victim. Criminals use leaked emails, usernames, and phone numbers as starting points to map additional accounts across social media, gaming platforms, and online stores. This process, known as identity chaining, can quickly connect your professional life to your personal and family digital footprint. A child’s gaming username listed in a family pool-installation record, for example, can be linked to an email address that was also exposed, giving attackers a path to compromise the child’s account and any linked payment methods.

Credential leaks like this one routinely cascade into account takeovers on unrelated services where the same password was reused. The result is doxxing: attackers publish or sell bundles that tie real names and home addresses to online handles, making targeted harassment or fraud significantly easier.

Incransom’s Publicly Known Track Record

Public reporting attributes Incransom with emerging in early 2024. The group has since claimed responsibility for attacks on dozens of organizations, primarily small and mid-sized businesses in the United States and Europe. Notable prior victims include regional manufacturers, professional service firms, and other local service companies. Its typical playbook begins with initial access gained through phishing or exploited remote-desktop credentials, followed by claimed exfiltration of internal files and deployment of ransomware. The group then uses a leak site to pressure victims with timed public disclosures if payment is not received. Extortion demands usually focus on both decryption and non-disclosure of the stolen data.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real-world identity so you can see exactly what chains back to the American Pools & Spas breach.
• Rotate any password you ever used when contacting or paying American Pools & Spas, and enable two-factor authentication with an authenticator app on every account where that password was reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information surfaces you learn within hours rather than months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that could be chained to the same exposed address or family name.
• Let remediation specialists handle takedown requests for any personal records that have already reached data brokers or underground marketplaces.

The incident shows that even routine transactions with local businesses can expose your family to long-term digital risk. Taking deliberate steps now limits how far attackers can travel along the identity chain that begins with this 500GB leak. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, including protection for your family’s and children’s gaming accounts that often become the next link in doxxing attempts.