Della Casa Group AG Listed by incransom Ransomware Group

On July 28, 2026, Swiss company Della Casa Group AG was listed on the leak site of the incransom ransomware group. The extortion actors published contact details for several executives along with a sample of what they claim is 86,332 internal files totaling more than 240 GB. Anyone whose personal or client information passed through the company is now at direct risk of identity theft and targeted fraud.

Reported Details from the Leak

The incransom listing states that the Swiss firm suffered a ransomware attack in which attackers exfiltrated internal files before encryption. The disclosure lists multiple Swiss phone numbers and email addresses belonging to company personnel, including s.pajaziti@dellacasa.group, gdc@dellacasa.group, a.stirnimann@dellacasa.group, a.marku@dellacasa.group, and d.meier@dellacasa.group. It explicitly claims the stolen data includes Personal / Client Information, Accounting / Finance records, Details of current and future projects, and other internal documents. The leak site does not disclose the total number of individuals affected, nor does it specify exactly which client records were taken.

Why This Matters for You and Your Family

If you or any member of your family has done business with Della Casa Group AG, your personal information may now sit inside a ransomware actor’s archive. Client information and financial records are among the most valuable datasets for identity thieves because they frequently contain full names, addresses, dates of birth, bank details, and tax identifiers. Once exposed, this data rarely disappears. It circulates on underground forums for years, increasing the chance that you or your spouse will become the target of impersonation scams, loan fraud, or tax-refund theft. Children listed on family accounts or medical forms connected to these projects are also exposed to long-term risks.

The Doxxing and Identity-Chain Risk

Ransomware leaks like this one rarely stop at the initial dump. The published executive emails and phone numbers serve as anchors that allow attackers and opportunistic criminals to map additional accounts. A single leaked work email can be used to reset passwords on personal services, uncover linked social-media profiles, and eventually tie everything back to your home address. This is exactly how doxxing chains begin. Credential leaks of this nature also cascade into gaming accounts belonging to you or your children; once an attacker controls an email address tied to a family member, they can hijack Steam, Roblox, Discord, or Epic accounts and use them for further social engineering. Continuous monitoring across 15.4B+ breach records and 100+ platforms is the only practical way most families can keep pace with these expanding chains.

Incransom’s Publicly Known Track Record

Public reporting attributes incransom as a relatively new double-extortion ransomware operation that emerged in late 2024. The group follows a now-standard playbook: gain initial access, exfiltrate sensitive files over weeks or months, deploy ransomware to encrypt systems, then publish samples on their leak site when the victim refuses to pay. Notable prior victims have included mid-sized European manufacturing and professional-services firms. Like most ransomware groups operating under the Ransomware-as-a-Service model, incransom uses both automated tools and human operators, frequently leveraging stolen credentials and remote-desktop vulnerabilities for entry. Their extortion style combines data leaks with direct pressure on named executives whose contact details are published alongside the samples.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real-world identity, then use the no-subscription cleanup of Warden to remove what you can.
• Rotate any password you have ever used at Della Casa Group AG or associated services, and immediately enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring so the next breach exposing your family is caught and acted upon within hours instead of months.
• Cover the entire household with DoxxScan family protection, which extends to dependents and children’s gaming accounts that often chain back to the same addresses and emails.
• Let remediation specialists handle data-broker takedown requests and opt-out processes that would otherwise consume dozens of hours of your own time.

The breach of Della Casa Group AG is another reminder that corporate ransomware incidents are now a permanent part of personal privacy risk. What organizations lose, your family ultimately inherits. DoxxScan by GalaxyWarden combines continuous monitoring across 15.4 billion breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists to give ordinary families the same defensive capabilities once reserved for large organizations. Protecting yourself and your children starts with seeing the full picture of where your data actually lives.