MTTEXPERTISES.COM Listed by incransom Ransomware Group

On June 6, 2025, the ransomware group Incransom added MTTEXPERTISES.COM to its public leak site, claiming that it had exfiltrated internal files from the Franco-Moroccan asset valuation firm during a ransomware attack.

What Public Reporting Shows

Public reporting indicates that MTT Expertises, founded in 2004 and accredited by the Moroccan Federation of Insurance and Reinsurance Companies, specializes in insurance capital estimation, risk management, and post-incident expertise. The company employs more than 40 professionals across offices in Casablanca, Agadir, Tangier, France, and other African countries. Available reporting describes the incident as a ransomware attack in which internal files were allegedly stolen before the company’s data appeared on the Incransom leak site. The exact number of individuals whose information may have been exposed remains unknown, and the specific types of documents published have not been detailed beyond the broad category of internal files.

Why This Matters for You and Your Family

When a professional services firm like MTT Expertises suffers a breach, the information stolen often includes details about clients, insurance claims, property valuations, and financial assessments. Internal files from such companies can contain names, addresses, dates of birth, policy numbers, and sometimes copies of identity documents belonging to ordinary people who hired the firm after an accident, fire, or natural disaster. If your family has ever used an insurance expert, loss adjuster, or valuation service in Morocco or France, your information could be among the records now in attackers’ hands. Once exposed, these records do not disappear; they circulate on underground forums and can be combined with other leaks to build a complete profile of your household.

The Doxxing and Identity-Chain Implications

Ransomware operators rarely stop at publishing one set of files. They frequently cross-reference stolen data with information from earlier breaches, creating long identity chains that link your work email to personal accounts, phone numbers, and family members. A single leaked insurance valuation document can reveal your home address, children’s names, or travel patterns. These details make it easier for criminals to impersonate you, file fraudulent claims, or target your family with phishing emails that appear legitimate because they reference real past incidents. Credential leaks like this one also cascade into account takeovers, especially for gaming accounts that often reuse the same passwords or recovery emails. Public reporting attributes similar patterns to many ransomware incidents where initial corporate data quickly fuels consumer-level doxxing and extortion attempts.

Incransom’s Publicly Known Track Record

Public reporting attributes Incransom with emerging in recent years as a ransomware operation that combines encryption of victim systems with public data leaks. The group’s typical playbook involves gaining initial access, exfiltrating sensitive files, deploying ransomware, and then pressuring victims through both operational disruption and the threat of publishing stolen data on its leak site. Notable prior victims have included companies across various sectors, though specific earlier cases are still being tracked by ransomware intelligence platforms. The group maintains a leak site where it posts evidence of compromise and sets deadlines for payment before releasing additional batches of data.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity so you can see exactly what this claimed breach connects to.
• Rotate any password you used at MTT Expertises or similar professional services firms anywhere it has been reused, and switch on 2FA using an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information surfaces you learn within hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and your children’s gaming accounts, which frequently become targets when credential leaks create doxxing chains.
• Let remediation specialists handle the follow-up work, including sending takedown requests to data brokers and monitoring for misuse of any exposed insurance or valuation records.

The incident shows that even specialized firms holding sensitive personal and financial details remain vulnerable, and the data they lose can affect your family for years. Starting now with concrete steps gives you the best chance of limiting damage before criminals combine this leak with others. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts.