teamsters175.org Listed by incransom Ransomware Group

On January 29, 2025, the Incransom ransomware group listed teamsters175.org on its leak site and published internal files stolen from the union local that has represented workers and their families in West Virginia, Kentucky, Ohio, and Virginia since 1940.

What's Publicly Reported from Reporting

Public reporting indicates the union’s internal documents were exfiltrated during a ransomware attack. The exact number of people whose information appears in the files remains unknown. Available reporting describes the data as internal files rather than a structured database of member records, though such documents frequently contain names, addresses, phone numbers, email addresses, and employment details. The leak site posting carries the typical extortion pressure associated with this group’s operations.

Why This Matters for You and Your Family

When a union local that serves working families is breached, the information exposed often belongs to everyday people — members, their spouses, and sometimes dependents. Internal files can include home addresses, dates of birth, Social Security numbers, and direct-deposit banking information. Once that data leaves the organization’s control, it can be sold, combined with other leaks, and used to file fraudulent tax returns, open accounts in your name, or target your family with phishing emails that look legitimate because they reference real union activities. For households already stretched thin, even one successful identity theft incident can create months of paperwork and financial damage.

The Doxxing and Identity-Chain Implications

Ransomware leaks like this one rarely stop at the first dataset. Attackers or buyers frequently cross-reference stolen internal files with usernames, email addresses, and phone numbers that appear in gaming accounts, social-media profiles, or older breaches. A union member’s work email paired with a child’s Roblox or Fortnite username can quickly form a chain that leads to physical addresses and family relationships. Public reporting shows these chains are then used for doxxing, swatting, or extortion campaigns that escalate far beyond the original breach. Credential leaks of this nature routinely cascade into account takeovers across personal and family gaming platforms.

Incransom’s Publicly Known Track Record

Public reporting attributes Incransom with emerging in late 2023. The group has targeted mid-sized organizations across North America and Europe, including manufacturing firms, local government entities, and nonprofit associations. Its typical playbook begins with initial access through phishing or exploited remote-desktop credentials, followed by exfiltration of sensitive files before encryption. The extortion style combines publication of stolen data on its dark-web blog with direct pressure on victims to pay to prevent release. Exact success rates are difficult to verify, but the group maintains an active leak site that lists new victims on a regular basis.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup to remove what you can.
• Rotate the password used at teamsters175.org anywhere it is reused and enable 2FA through an authenticator app rather than text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak that touches your family is caught in hours, not months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same address or parent email.
• Let the remediation specialists handle takedown requests across data brokers and exposed profiles while you focus on securing accounts.

The incident underscores that union membership records are now high-value targets in ransomware campaigns that can affect any working family. Taking concrete steps now limits how far attackers can travel down the identity chain that begins with this leak. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that explicitly includes children’s gaming accounts. Start your DoxxScan trial today to map and close the gaps before the next wave of abuse begins.