Lawants Breached by INC Ransom Group
Spanish company Lawants (lawants.com) suffered a ransomware attack claimed by the INC_RANSOM (Incransom) group. The actors reportedly exfiltrated 100GB of data including confidential documents, client information, financial records, NDAs, and business agreements. The claim surfaced publicly on May 28-29, 2026.
- financial
- confidential-documents
- client-data
A Spanish digital marketing agency, Lawants, has had approximately 100GB of sensitive internal data exfiltrated by the ransomware group INC_RANSOM, with the claim made public on 28-29 May 2026. The compromised material includes financial records, confidential documents, client data, non-disclosure agreements, and business contracts, according to available reporting. The number of individuals whose personal or corporate information was exposed remains unknown.
Public reporting from Breachsense indicates that the attackers gained access to Lawants’ systems and removed the data before encrypting or disrupting operations. The INC_RANSOM group, also known as Incransom, published proof of the breach on their leak site, displaying samples of the stolen files. Lawants, which provides web development, SEO, and online advertising services to businesses across Europe, has not yet issued a formal public statement confirming the incident’s scope or timeline. Industry research from sources such as DoxxScan™ continuous monitoring indicates that marketing and professional-services firms frequently store mixed personal and corporate data in the same repositories, increasing the blast radius when a single breach occurs.
Want the rest of this breakdown?
Sign up free to keep reading. Members get extended access, the weekly breach digest, and a complimentary Warden™ to see if their identity is exposed in the breaches we cover.
A breach leaks your credentials. Then hackers chain those credentials to your address, family, phone, and employer using public broker sites. We’re the only tool built around that chain.
⚠ Were you in this breach?
Free email scanner. We check your address against 15.4B+ leaked records (including this breach) in 15 seconds — then show you the $19 cleanup that removes you from the broker sites aggregating leaked data.
Check my email — free →
