INC Ransom Claims Attack on AT&T-Linked Domain, Alleges 2 TB Stolen
The criminal group posted the claim on October 15, 2026. AT&T has not confirmed any incident, and the listing could not be independently verified.
Key points
- INC Ransom listed a domain linked to AT&T on its dark-web leak site on October 15, 2026, claiming to have stolen 2 TB of data, according to the group's own post.
- The claim is unverified; AT&T has not publicly confirmed any incident as of this writing.
- This is the fourth INC Ransom story Threat Vectr has covered since 28 September 2026.
- The listing was first observed by the monitoring service Ransomware.live.
On October 15, 2026, the criminal ransomware group INC Ransom added a listing to its dark-web leak site naming a domain associated with AT&T. Ransomware is malicious software criminals use to lock a company's files and systems, then demand payment to restore access. Leak sites are a separate pressure tactic: groups publicly name victims to embarrass them and push them toward paying, sometimes before any negotiation concludes.
The group's post claimed a theft of 2 TB of data. That figure comes entirely from the attackers. Listings like this are written to pressure companies, and independent researchers can't confirm what, if anything, was actually taken. AT&T has not publicly acknowledged the claim, and it couldn't be independently verified at publication time. Ransomware.live, the monitoring service that observed the listing, does not verify claims either.
How serious is INC Ransom as a group?
Serious enough to watch. We've covered the group four times since 28 September 2026, including a claim against US firm Magnals.com on 7 October and a listing targeting a Richmond school for students with dyslexia on 8 October. The pattern is consistent: unverified listings, large and recognizable targets, pressure before any public confirmation.
A claim against an AT&T-linked domain fits that pattern. Naming a company doesn't mean the attack succeeded or that data was actually taken.
| Metric | Figure |
|---|---|
| Data volume claimed in this listing | 2 TB (per group's post) |
| Listing date | October 15, 2026 |
| Listing first observed by | Ransomware.live |
Should you worry?
Nothing's confirmed, but a few sensible steps cost nothing. Watch for phishing emails where criminals pose as AT&T or a government agency asking you to verify your account or claim breach compensation. Those scams spike when a company's name appears in security news.
If you reuse your AT&T account password on other services, change it on those other accounts now. One unique password per service is the most effective personal precaution available.
Be skeptical of unsolicited calls claiming to offer compensation or account protection related to a breach. Legitimate companies don't cold-call customers demanding personal details to process a refund.
Monitor your account statements. If AT&T does confirm any incident, follow whatever guidance the company publishes at that point.
One group's unverified claim is the beginning of a story, not the end of one.
