The Incransom ransomware group has listed two new alleged victims on its leak site on 8 November 2026: BPCM, a professional services firm in the United States, and Q-Technicians, a professional services firm in Belgium. Both listings remain unverified claims at this stage, with neither company publicly confirming an incident.

According to QPulse Intelligence, the BPCM listing was discovered at 03:48 UTC on 8 November, with the attackers claiming to have obtained all company data. Threat intelligence from HudsonRock linked infostealer activity to the incident, including 440 exposed passwords, 13 of them flagged as critical, and one third-party employee credential.

The Q-Technicians listing appeared minutes later, at 03:49 UTC, according to a second QPulse brief. In that case HudsonRock reported no compromised employees or users directly identified, but one compromised third-party employee credential. No details have been given about what data, if any, was taken from either organisation, or about the current state of their systems.

Incransom, also known as INC Ransom, is a ransomware-as-a-service operation active since July 2023. It has listed close to 1,000 victims since August 2023 and typically follows a double-extortion model, stealing data before encrypting systems so it can threaten to publish it.

The two listings underline a pattern defenders keep seeing: infostealer malware harvesting credentials first, then ransomware groups using those credentials, including third-party and vendor accounts, as a way in. Organisations are advised to audit infostealer logs, reset exposed passwords, enforce multi-factor authentication on third-party access, and review vendor access controls.