Core Supply Listed by incransom Ransomware Group

On February 10, 2026, Core Supply appeared on the leak site of the incransom ransomware group, with the attackers claiming to have exfiltrated internal files during a ransomware attack on the company.

What's Publicly Reported from Reporting

Public reporting indicates that Core Supply, a business operating since 2010 that emphasizes partnerships with customers and suppliers, had internal files taken. The incident was listed on the group’s leak site hosted on an onion domain, with the specific disclosure reference 698600708f1d14b743d63501. Available reporting describes the data as internal files, though the exact volume and full list of contents remain unclear. No confirmed victim count for individuals has been published, and it is not yet known precisely which categories of information—such as customer records, employee details, or supplier contracts—were included.

Why This Matters for You and Your Family

When a company like Core Supply suffers a breach, the information it holds about ordinary customers, vendors, and employees can end up in the hands of criminals. Internal files often contain names, addresses, phone numbers, email accounts, dates of birth, and sometimes payment details or government identifiers. If your family has done business with Core Supply or any of its partners since 2010, your information may now be exposed. Once that data reaches ransomware operators, it rarely stays contained. It can be sold, traded, or used to launch further attacks against you personally.

Credential leaks from business compromises frequently cascade into personal account takeovers. A password or email address stolen from a supplier file can unlock your online banking, email, or social media if you have reused it. For families this risk extends to children whose details sometimes appear in school forms, sports registrations, or family-linked supplier accounts.

The Doxxing and Identity-Chain Implications

Ransomware groups do not stop at posting data. They map connections between leaked corporate records and personal identities, creating what security analysts call an identity chain. A single email address found in Core Supply’s files can be cross-referenced with gaming accounts, social profiles, and data-broker records. This process turns one breach into a roadmap for doxxing, targeted phishing, or even physical intimidation. Public reporting on similar incidents shows that children’s gaming usernames and associated parent emails are frequently chained together, exposing younger family members to harassment or account theft.

Incransom’s Publicly Known Track Record

Public reporting attributes the incransom group with emerging in recent years as a ransomware operation that combines encryption of victim systems with public data leaks. The group’s typical playbook involves initial access through common vulnerabilities or stolen credentials, followed by exfiltration of internal documents, deployment of ransomware, and then dual extortion: demanding payment to decrypt systems and a second payment to prevent publication of stolen files. Notable prior victims listed on their leak site include other mid-sized businesses whose internal files were posted after negotiations failed. Exact details of every past incident vary, but the pattern of listing companies on their onion blog and applying pressure through public exposure has remained consistent.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity so you can see exactly what the Core Supply leak may have exposed.
• Rotate any password you used at Core Supply or any of its partner companies, then enable two-factor authentication through an authenticator app on every account where that password was reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information surfaces you learn within hours rather than months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often become targets when corporate leaks create doxxing chains.
• Let remediation specialists handle takedown requests across data brokers and exposed profiles while you focus on securing your own accounts.

The Core Supply incident is a reminder that corporate breaches quickly become personal ones. Taking concrete steps now limits how far attackers can travel down the identity chain that begins with a single leaked file. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts—capabilities that directly address the cascading risks shown in this attack.