ERoko Distributors + Colonial Countertops Listed by INC Ransom Ransomware Group

On August 24, 2024, the ransomware group Incransom added E. Roko Distributors and its affiliated entity Colonial Countertops to its public leak site, claiming that internal files had been exfiltrated during a ransomware attack on the British Columbia-based distributor.

Reported Details from the Listing

The Incransom leak-site entry states that internal files were taken after the company fell victim to a ransomware attack. The disclosure does not quantify how many records were affected, nor does it list specific data types beyond the general description of internal files. E. Roko Distributors, which has operated for more than 35 years supplying cabinet makers, millworkers, furniture manufacturers and contractors across British Columbia, Alberta and Washington State, has not yet published its own customer notification detailing the breach. The exact volume of data and the precise systems compromised remain unknown from the primary listing.

Why This Matters for You and Your Family

When a supplier like E. Roko Distributors suffers a ransomware breach, anyone who has done business with them — whether as a residential customer, contractor, or through a cabinet maker or millworker — may have personal information sitting in the stolen files. This can include names, addresses, phone numbers, email addresses, payment details or order histories. Even if you never directly interacted with their systems, your information could have been shared by a contractor or retailer. The exposure creates immediate risks of identity theft, phishing campaigns and unwanted solicitations targeted at you and your household.

Internal files from a distributor often contain spreadsheets that link customer identities to physical addresses, purchase patterns and contact information. Once that data leaves the company’s control, it can be sold, repurposed or used to launch follow-on attacks against your family.

Doxxing and Identity-Chain Implications

Ransomware leaks rarely stop at one company. The stolen files can serve as the starting point for doxxing chains that connect your work or home address to email accounts, phone numbers, online usernames and even your children’s gaming profiles. Threat actors routinely cross-reference supplier customer lists with other breached databases to build detailed profiles. A single address or phone number found in E. Roko’s files can link to your social-media handles, loyalty-program accounts or family members’ information, turning a corporate breach into sustained personal exposure.

Incransom’s Known Track Record

Public reporting attributes Incransom with emerging in late 2023 as a ransomware-as-a-service operation that focuses on double-extortion tactics. The group typically gains initial access through phishing or exploited remote-desktop services, exfiltrates data before deploying ransomware, then publishes samples on its leak site when victims refuse to pay. Notable prior targets have included mid-sized manufacturing, distribution and professional-services firms. Their playbook emphasizes steady pressure through partial data dumps and deadlines rather than immediate mass publication, though the precise success rate and average ransom demands remain difficult to verify from open sources.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers and real identity, including any data that may have surfaced from this supplier breach.
• Rotate passwords used with any contractor, cabinet maker or supplier tied to E. Roko Distributors and enable 2FA through an authenticator app everywhere those credentials are reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your information is caught in hours rather than months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which frequently become targets when credential leaks cascade into account takeovers and doxxing chains.
• Let remediation specialists handle takedown requests across data brokers and extortion sites on your behalf while you focus on securing your own accounts.

The incident underscores how supplier and distributor breaches continue to expose ordinary customers long after the initial attack. Staying ahead requires more than changing a password; it demands visibility into how your information travels across breaches and platforms. DoxxScan by GalaxyWarden delivers that visibility through continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Source: Incransom leak site via ransomware.live