Sarulla Operation Listed by INC Ransom Ransomware Group

On November 11, 2025, the incransom ransomware group added Sarulla Operation to its leak site and began publishing internal documents that include over 1,000 passports, financial records, budgets, account balances, contracts, user information, and payment instructions.

Reported Details of the Breach

Public reporting indicates the incident stems from a ransomware attack in which attackers exfiltrated large volumes of internal files before encrypting systems. The data categories listed on the leak site cover administration, financial operations, budgets, account balances, user records, confidential information, payment instructions, accounting documents, contract discussions, and final contracts. The group has not publicly stated how many individuals are affected, but the presence of more than 1,000 passports suggests the breach touches employees, contractors, partners, or customers whose identity documents were stored in Sarulla’s systems.

Available reporting describes the leak site posting as the group’s standard method of applying pressure after initial negotiations fail. No evidence has surfaced that the data was sold to third parties prior to the public disclosure, but the files remain accessible on the onion site.

Why This Matters for You and Your Family

When a company loses control of passports, contracts, and financial details, the information can be used to open accounts, file fraudulent tax returns, or impersonate victims in official settings. If your passport, bank details, or employment records were among the stolen files, you and your family could face years of cleanup. Children’s information linked to a parent’s work records can also become targets, turning a corporate breach into a household problem. Over 1,000 passports exposed in one posting is a concrete reminder that personal documents stored by employers or vendors are not always protected as carefully as people assume.

The Doxxing and Identity-Chain Risks

Passports and contracts often contain full names, dates of birth, addresses, and sometimes family member references. Attackers can combine these with usernames or emails found in the same dataset to build detailed profiles. A single leaked work email can link to personal gaming accounts, social-media handles, and phone numbers. Once those connections are mapped, credential-stuffing attacks become far more effective. Credential leaks like this one frequently cascade into account takeovers on gaming platforms, where children’s accounts are especially vulnerable because parental email addresses and shared passwords are commonly reused.

Incransom’s Publicly Known Track Record

Public reporting attributes the group’s emergence to mid-2024. It has since targeted organizations across multiple sectors, typically gaining initial access through phishing or exploited remote desktop services. After exfiltrating sensitive files, the group follows a double-extortion playbook: it demands payment to prevent publication and threatens to release the data on its leak site if the deadline passes. Notable prior victims include manufacturing and logistics companies whose financial and employee records were posted in similar fashion. Exact success rates remain unclear, but the group consistently publishes samples when victims do not meet its payment demands.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity so you can see exactly what chains back to the Sarulla files.
• Rotate any password you used at Sarulla Operation or any related vendor and enable 2FA through an authenticator app instead of text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your data is caught in hours rather than months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts commonly targeted after credential leaks.
• Let remediation specialists handle takedown requests for any exposed personal documents or broker listings tied to the incident.

The incident shows that even organizations you never interact with directly can hold documents that put your family at risk. Taking concrete steps now limits how far attackers can travel down the identity chain. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage that includes children’s gaming accounts. Start your DoxxScan trial today to understand your exposure and begin closing the gaps.