On September 30, 2023, the ransomware group known as donutleaks listed INC on its leak site, claiming that internal files had been exfiltrated from the company during a ransomware attack. The listing, hosted on the Tor-based donutleaks portal and indexed by ransomware.live, marks the public disclosure of the incident and signals that negotiations between the attackers and the victim have either failed or reached an impasse.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Watch UPDATED
Get alerted the next time UPDATED files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about UPDATED’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
Details in the Leak-Site Listing
The primary disclosure on the donutleaks site states that internal files were exfiltrated in a ransomware attack. It does not quantify the number of records affected, name the specific systems compromised, or list exact data types beyond the generic description of internal files. The posting includes the standard extortion language common to these groups and provides a direct onion link for verification. The disclosure indicates the data was stolen and is now available for download or further publication if the victim does not comply with the group’s demands. No ransom amount or payment deadline is detailed in the public listing itself.
Why This Matters for You and Your Family
When a company’s internal files are stolen and listed on a ransomware leak site, the exposure often reaches far beyond corporate walls. Employee records, vendor contracts, customer information, or even personal details shared in everyday business communications can end up in the hands of criminals. For ordinary people whose data was inside those files, this means heightened risk of identity theft, phishing campaigns tailored with real internal knowledge, and long-term financial fraud. Your family’s addresses, dates of birth, Social Security numbers, or contact information may have been swept up without your knowledge, turning a corporate breach into a personal threat that can surface months or years later.
The Doxxing and Identity-Chain Implications
Ransomware operators rarely stop at dumping raw files. Once internal data leaves the victim’s network, it enters underground markets where brokers link disparate pieces of information into complete identity profiles. An email address found in one document can be chained to usernames on gaming platforms, social media, or shopping sites. This creates doxxing chains that expose your real name, home address, phone number, and family relationships. Credential leaks from these incidents frequently cascade into account takeovers, especially for gaming accounts belonging to you or your children. A single breach can therefore become the starting point for sustained harassment, SIM-swapping attempts, or targeted social engineering against your household.