selp Listed by INC Ransom Ransomware Group

On December 28, 2025, the French company selp.fr appeared on the leak site of the incransom ransomware group. The attackers claim to have stolen confidential documents, client data, NDAs, financial records, operational files, corporate information, business agreements, source code, and other sensitive materials from the firm, whose clients include Apple, Loreal, Google, and Ikea.

Reported Details of the Breach

Public reporting indicates that selp.fr suffered a ransomware intrusion in which internal files were exfiltrated before encryption or as part of the attackers’ double-extortion tactic. The incransom group posted screenshots and descriptions of the stolen data on its leak site, listing categories that range from client databases to proprietary source code. The exact number of individuals whose personal information may have been exposed remains unknown, as does the precise volume of records taken.

Available reporting describes the incident as a classic ransomware data-theft operation: initial access, exfiltration of sensitive material, and subsequent public shaming on a dedicated leak portal when the victim did not meet the group’s demands. No independent verification of the full dataset has been published, but the group’s post leaves little doubt that corporate and client records were removed from selp.fr’s environment.

Why This Matters for You and Your Family

When a company that handles business for major brands is breached, the ripple effects often reach ordinary customers. If you or anyone in your household has interacted with selp.fr, Apple, Loreal, Google, or Ikea in ways that generated shared documents, contracts, or personal records, your information could now sit in an attacker’s archive. Client data and financial data are particularly dangerous because they can be used for identity theft, fraudulent loans, or targeted phishing.

Even if you never directly hired selp.fr, the exposure of NDAs, business agreements, and source code increases the chance that employees’ personal details—addresses, phone numbers, or internal email correspondence—will surface in follow-on leaks. Once that happens, your family’s privacy shrinks. A single exposed email or phone number becomes the starting point for scams, account takeovers, and harassment that can affect every member of the household.

The Doxxing and Identity-Chain Risks

Ransomware leaks rarely stop at the first company. Stolen client lists and contact databases are frequently resold or traded on underground forums, creating long chains of exposure. A leaked corporate email can be linked to personal accounts, gaming usernames, or family addresses. Attackers then use these connections to impersonate you, reset passwords elsewhere, or publish your information for public harassment.

Credential leaks like this one cascade into account takeovers and doxxing chains. Children’s gaming accounts are especially vulnerable because kids often reuse email addresses or passwords tied to family data. A single breach at a vendor like selp.fr can therefore endanger not just your work identity but your entire digital household.

Incransom’s Publicly Known Track Record

Public reporting attributes the incransom group with a series of ransomware campaigns that emerged in recent years. The actors typically gain initial access through phishing, remote desktop protocol weaknesses, or stolen credentials. After exfiltrating data they encrypt systems and demand payment, publishing samples on their leak site when victims refuse to pay. Notable prior victims have included mid-sized service providers and technology consultancies whose client lists overlapped with major consumer brands. Their playbook relies on pressure through public exposure rather than prolonged negotiation, aiming to force rapid settlement by threatening to release contracts, source code, and customer databases.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity so you can see exactly what this claimed breach may have exposed.
• Rotate any password you used at selp.fr or any of its clients anywhere else it is reused, and switch on two-factor authentication through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information appears it is caught within hours instead of months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same addresses and credentials.
• Let remediation specialists handle takedown requests across data brokers and leak sites so you do not have to chase every copy of your information yourself.

The selp.fr incident is a reminder that vendor breaches can expose your family even when you never signed a contract with the victim company. Taking concrete steps now limits how far attackers can travel down the identity chain that begins with this leak. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage including children’s gaming accounts.