geleximco.vn Listed by Incransom Ransomware Group

On August 04, 2026, the ransomware group Incransom publicly listed Vietnamese company geleximco.vn on its leak site, claiming to have exfiltrated 200 GB of internal files during a ransomware attack. The organization has not, as of this writing, issued any public confirmation or breach notification. According to the leak-site listing, the data was taken in a ransomware operation, and the group is using the publication as leverage in its extortion campaign.

Claims Made by Incransom

The Incransom leak-site entry states that it compromised geleximco.vn and successfully exfiltrated internal files totaling roughly 200 GB. The listing does not specify exactly which systems were accessed, which file types were taken, or the number of individuals whose information may be contained in the archive. Because the sole primary source is the threat actor’s own leak page, this remains an unconfirmed claim. The company has not acknowledged the incident, so it is not yet possible to treat the breach as verified fact.

Why This Matters for You and Your Family

When a company that handles employment, contracts, financial transactions, or supplier records is targeted, the information inside those internal files often includes names, addresses, government ID numbers, banking details, and correspondence belonging to ordinary customers, employees, and vendors. Even though the exact contents remain unknown, the scale — 200 GB — suggests a substantial volume of business documents that could expose personal data belonging to you or members of your household. A single leaked employment record or vendor agreement is frequently enough to map someone’s full identity chain.

Doxxing and Identity-Chain Risks

Ransomware operators routinely publish or sell stolen directories, employee spreadsheets, contracts, and scanned documents. These files commonly contain home addresses, phone numbers, national identification numbers, and email accounts. Once such data surfaces, it is quickly cross-referenced with credential leaks, gaming accounts, and social-media handles. A child’s Roblox or Minecraft username tied to a reused parent email can rapidly link back to the same residential address now circulating in the Incransom dataset. This is exactly how targeted doxxing and follow-on fraud begin. DoxxScan by GalaxyWarden uses continuous monitoring across 13.1 billion breach records and more than 100 platforms together with AI-powered identity-chain mapping to reveal these connections before malicious actors can exploit them.

Incransom’s Known Track Record

Public reporting attributes Incransom with emerging in late 2024 as a double-extortion ransomware operation. The group typically gains initial access through phishing or exploited remote-desktop services, exfiltrates data before deploying encryption, and then pressures victims with both file-leak threats and ransom demands. It has listed manufacturing, logistics, and regional corporate targets across Southeast Asia. Its playbook follows the now-standard ransomware pattern: steal first, encrypt second, and publicly shame non-payers on its dedicated leak site. Because the geleximco.vn listing follows this exact pattern, the claim is consistent with Incransom’s established behavior even though independent verification is still absent.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real-world identity, then use the no-subscription cleanup to begin removing exposed records yourself.
• Enable continuous DoxxScan monitoring so any future exposure of your information — including data that surfaces from this or similar incidents — is flagged within hours rather than months.
• Rotate passwords used at geleximco.vn or any related vendor portals anywhere those credentials are reused, and switch to 2FA through an authenticator app instead of SMS.
• Assume a leaked home address from corporate files endangers everyone living at that location; your own timely data-removal requests are what ultimately take that address out of circulation on data-broker sites.
• Let remediation specialists handle formal takedown requests across brokers and leak repositories so you do not have to negotiate directly with threat actors or shady intermediaries.

The incident underscores a persistent reality: corporate ransomware claims can place your personal details into circulation long before any official admission appears. Staying ahead requires more than reactive checks — it demands ongoing visibility into how your identity is linked across the expanding web of breaches and leaks. DoxxScan by GalaxyWarden gives individuals exactly that capability through continuous monitoring, identity-chain mapping, and hands-on specialist remediation.