TransCore ITS, LLC Listed by crypto24 Ransomware Group

On March 31, 2025, the ransomware group known as crypto24 added TransCore ITS, LLC to its leak site after breaching the company’s Dubai office and exfiltrating more than 200 GB of internal data.

What's Publicly Reported from Reporting

Public reporting on the ransomware.live portal states that attackers gained access to TransCore’s internal network in Dubai. The stolen material includes in-development source code, full file sets from both active and archived client projects, internal financial records, and a large volume of customer data that was stored without proper safeguards. The group claims the files contain clear violations of multiple NDAs and expose confidential third-party materials.

At the time of publication, the exact number of individuals whose information was taken remains unknown. No sample data has been publicly released, and TransCore has not issued a formal statement detailing the scope or notifying affected customers.

Why This Matters for You and Your Family

When a logistics and intelligent transportation systems provider like TransCore loses control of customer records, the ripple effects reach ordinary people whose addresses, contact details, payment information, or project files may now sit on a criminal leak site. If your family has ever used services tied to tolling systems, freight management, or smart-mobility platforms that rely on TransCore technology, your information could be part of the exposed trove.

Customer data and financial records are valuable precisely because they link real identities to financial activity. Once available, this information can be sold quietly or used to launch follow-on attacks that feel personal—unauthorized account access, targeted phishing, or identity theft that can take months to discover.

The Doxxing and Identity-Chain Implications

A single breach rarely stops at one company. The files allegedly taken from TransCore contain project details, client lists, and internal documents that often list email addresses, phone numbers, project contacts, and sometimes home addresses. Criminals routinely chain these fragments together with data from earlier breaches to build complete profiles.

Credential leaks of this nature frequently cascade into account takeovers on unrelated services. A password or email address reused from a TransCore-related account can open the door to email, banking, or social-media profiles. When children’s names or school-related project files are included, gaming accounts tied to the same household email become easy secondary targets for doxxing or extortion.

Crypto24’s Publicly Known Track Record

Public reporting attributes the crypto24 group with emerging in late 2024. The gang has focused primarily on mid-sized organizations across logistics, technology services, and professional sectors. Notable prior victims listed on ransomware leak sites include smaller transportation firms and software developers whose client data was later used for extortion.

The group’s typical playbook involves initial access through compromised credentials or unpatched remote desktop services, followed by exfiltration of large document repositories. They then publish samples or full archives on their leak site if the victim does not pay within their stated deadline. Their extortion style combines data leaks with threats to notify the victim’s clients and partners about NDA violations.

What to do

• Rotate any password you have ever used for TransCore-related services or client portals and enable 2FA through an authenticator app rather than SMS.
• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity so hidden connections surface before criminals exploit them.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your information is caught in hours rather than months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often chain back to the same addresses or parent emails exposed in breaches like this.
• Let remediation specialists handle takedown requests across data brokers and leak sites so you do not have to negotiate directly with threat actors or spend weeks chasing down each copy of your data.

The speed with which stolen corporate data reaches criminal marketplaces means ordinary families must treat every breach as a personal risk. Starting with a clear picture of where your information already appears online remains the most practical defense. Try DoxxScan for its continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage that includes children’s gaming accounts.