INC Ransom Claims Energy and Construction Sectors Breach: ACWA Power Saudi Arabia and Larsen & Toubro India Data LeakedÂ
Published
Key Takeaways
- Massive Data Exfiltration: INC Ransom claims to have exfiltrated approximately 400 GB of sensitive data from energy giant ACWA Power and construction conglomerate Larsen & Toubro.
- Critical Infrastructure Targets: The alleged breach targets the energy and construction sectors, compromising technical specifications, engineering drawings, and project documentation.
- Verification Pending: While the threat actor has published internal documents as proof of compromise, the full extent of the breach remains under verification.
The INC Ransom hacking group has listed two major multinational corporations, Saudi Arabia-based ACWA Power and India-based Larsen & Toubro, on their leak site on February 24, 2026. The group claims to have successfully breached the networks of these critical infrastructure entities and published internal documents to substantiate claims.
This is a common double-extortion tactic used to pressure victims into paying ransoms.
Details of the ACWA Power Data Breach and L&T Compromise
The scope of the alleged ACWA Power data breach and Larsen & Toubro cyberattack appears extensive, with the threat actors boasting a cache of 400 GB of data. The leaked proofs indicate the alleged compromise of highly sensitive intellectual property and operational data.Â
The exposed datasets reportedly include:
- ISO certifications,Â
- detailed technical specifications,Â
- proprietary engineering drawings,Â
- invoices,Â
- project documentation.Â
The exfiltration of such granular technical data poses severe risks, potentially exposing critical infrastructure vulnerabilities and trade secrets, but the breach has not been confirmed.
INC Ransom Targeting
The INC Ransom hacking group has a history of targeting high-value enterprises. Security teams in the energy sector are advised to monitor for indicators of compromise (IoCs) associated with INC Ransom and review third-party access controls immediately.
Last month, an INC Ransom backup server security fail enabled 12 American companies to recover their data, and the gang claimed an attack on automotive supplier Yazaki Group in December.
In November 2025, the U.S. CodeRED Emergency Alert System was disabled by a data breach that INC Ransom claimed.
Related
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular