onsolve.com Listed by INC Ransom Ransomware Group

On November 1, 2025, critical event management provider OnSolve appeared on the leak site of the ransomware group known as Incransom, with the attackers claiming to have exfiltrated internal files during a ransomware incident.

What Public Reporting Shows

Public reporting indicates that OnSolve, which supplies AI-powered risk intelligence, critical communications, and incident management technology to organizations and government agencies, had internal files taken. The data exposed consists of internal documents rather than a confirmed list of customer or employee records. No exact victim count has been published, and the precise volume or sensitivity of the files remains unclear from available reporting. The incident follows the typical ransomware pattern of initial access, data exfiltration, and subsequent extortion pressure through public leak threats.

Why This Matters for You and Your Family

When a company that helps organizations respond to physical threats suffers a breach, the ripple effects can reach ordinary people whose information ends up in stolen files. If your employer, school, local government, or community organization uses OnSolve’s platform, details such as contact information, emergency notification lists, or location data linked to your family could be among the internal records now in attackers’ hands. Credential leaks from such incidents often cascade into account takeovers that affect personal email, banking, and online services you rely on daily.

Even when the initial breach does not list your name, the information can be combined with data from earlier leaks to build a profile that puts your household at risk of identity theft, phishing, or harassment.

The Doxxing and Identity-Chain Implications

Ransomware operators rarely stop at dumping random files. They map relationships between corporate data and personal accounts, turning a business breach into personal exposure. A single email address or phone number allegedly taken from OnSolve’s internal systems can be linked to your social media handles, children’s gaming usernames, or family addresses. Once these connections are made, attackers or opportunistic criminals can launch doxxing campaigns that publish home addresses, phone numbers, and family member names. Credential leaks like this one frequently lead to gaming account takeovers, especially for children whose usernames and passwords appear in chained data sets.

Incransom’s Publicly Known Track Record

Public reporting attributes the Incransom group with emerging in recent years as a ransomware operation that combines data theft with extortion. The group’s typical playbook involves gaining initial access to corporate networks, exfiltrating sensitive files before deploying ransomware, and then pressuring victims with deadlines to pay or face public disclosure on their leak site. Notable prior victims have included various organizations whose internal documents were later published when negotiations failed. Exact details of earlier attacks vary across reports, but the pattern of exfiltration followed by timed public leaks remains consistent.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity so you can see exactly what chains back to the OnSolve breach.
• Rotate any password you used at OnSolve or related services anywhere it has been reused, and switch to 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing you or your family is caught in hours instead of months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts, which often become targets when credential leaks cascade into doxxing chains.
• Let remediation specialists handle takedown requests across data brokers and exposed profiles while you focus on securing accounts at home.

The OnSolve incident shows how quickly corporate ransomware leaks can become personal threats to ordinary families. Taking concrete steps now limits the damage from this claimed breach and prepares you for the next one. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that connects online handles to real identities, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Start your DoxxScan trial today to regain control over what attackers can find about you.