https://daricon.com/ Listed by INC Ransom Ransomware Group

On February 25, 2026, the incransom Ransomware Group listed Daricon.com on its leak site and began publishing 400 GB of stolen internal files. The data includes correspondence with NATO and US Army employees, confidential documents, signatures of NATO generals, passport addresses, shipment records, photos, videos, drawings, employee emails, phone numbers, contracts with the Canadian and US Army, and documentation tied to oil operations in Iraq, Uganda, and other locations. Anyone whose personal or professional details appear in these files — including service members, contractors, and their families — now faces immediate risks of identity theft, targeted scams, and physical exposure.

What Public Reporting Shows

Public reporting on the incransom leak site describes the theft as the result of a ransomware attack on Daricon.com. The group claims to have exfiltrated the full 400 GB dataset and has begun releasing samples. Available reporting confirms the presence of personal data, emails, phone numbers, and documents bearing signatures and passport addresses of NATO generals. Contracts with the US and Canadian armies, along with internal correspondence involving military and government personnel, are also listed among the exposed materials. No exact victim count for individuals has been released.

Why This Matters for You and Your Family

When military contractors and government suppliers are breached, the information rarely stays inside corporate walls. Names, email addresses, phone numbers, and physical addresses can be combined with publicly available data to locate you or your relatives. Passport addresses and signatures are especially valuable because they can be used to forge documents or impersonate officials. If you or a family member works with defense contractors, oilfield services, or any company mentioned in the leak, your details may already be circulating among criminals who buy and sell such packages on dark-web forums.

Children are not immune. Gaming accounts linked to family email addresses or phone numbers often become secondary targets once the primary breach is known. A single leaked credential can lead to account takeovers that expose chat logs, location data, and real-world connections.

The Doxxing and Identity-Chain Implications

Ransomware groups like incransom do not limit themselves to one leak. They publish samples to pressure victims and then sell or trade the full archive. Once the data reaches broader criminal networks, automated tools link email addresses to usernames, phone numbers to social-media profiles, and home addresses to family members. This creates an identity chain that can be exploited for weeks or months after the initial disclosure. Public reporting indicates that correspondence and contracts in the Daricon files contain enough context to map relationships between employees, contractors, and military personnel. That mapping turns a simple data breach into a roadmap for harassment, spear-phishing, or physical targeting.

Incransom’s Publicly Known Track Record

Public reporting attributes the incransom Ransomware Group with emerging in late 2024. The group has targeted mid-sized enterprises and service providers, often focusing on organizations with government or defense ties. Its typical playbook involves initial access through phishing or unpatched remote-desktop services, followed by claimed exfiltration of sensitive files before encryption. Extortion combines public leak-site pressure with direct demands sent to executives. Prior victims have included companies in logistics, energy, and technology sectors. The group’s leak site continues to publish new victims on a regular schedule, suggesting an active and expanding operation.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real-world identity so you can see exactly what the Daricon files expose about you and your household.
• Rotate any password used at Daricon.com or related contractor accounts anywhere it has been reused, and switch to 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next credential leak that touches your family is caught and addressed within hours, not months.
• Cover the household with DoxxScan family protection, which extends to dependents and children’s gaming accounts that often chain back to the same addresses and phone numbers now appearing in the leak.
• Let DoxxScan remediation specialists handle takedown requests for any personal data already surfacing on data-broker and paste sites tied to this incident.

The Daricon breach is a reminder that contractor supply chains remain a soft target for ransomware operators. Acting quickly on the credentials and personal details already exposed can limit how far the identity chain stretches. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that connects handles to real identities, and hands-on remediation by specialists who manage takedowns for you. Its household coverage includes children’s gaming accounts that frequently become the next link in doxxing attempts after leaks like this one.