Harbor Pacific Ransomware Claim by INC Ransom (Oct 2026)

Claim Summary

On or around October 6, 2026, the ransomware group tracked as “incransom” allegedly listed Harbor Pacific Contractors, Inc. (harborpacific.com) on its dark web leak site. According to the threat actor’s post, the company - a Pacific Northwest industrial, mechanical, and heavy civil construction firm serving Washington, Oregon, and Alaska - has been added to its roster of claimed victims.

The group claims to have exfiltrated data during the intrusion, though the specific volume of allegedly stolen information remains undisclosed. The leak site entry purportedly includes basic corporate details such as employee count (approximately 20), estimated revenue ($5 million), and a publicly listed phone number. None of these claims have been independently verified by Yazoul Security or any third party.

It is important to note that a leak site listing is not proof of a successful breach. Ransomware operators frequently publish victim names before, during, or even without completing a full data exfiltration, using public pressure as a negotiation tactic.

Threat Actor Profile

The group operating as incransom is a ransomware-as-a-service (RaaS) operation that has been active in various forms since approximately 2023. Public research on this specific group remains limited, and its total number of confirmed victims is unknown. The group is generally associated with double extortion tactics - encrypting victim systems while threatening to publish allegedly stolen data.

Known or suspected tooling linked to INC Ransom affiliates has historically included commodity offensive security tools such as Cobalt Strike, AnyDesk, and various legitimate remote monitoring and management (RMM) utilities abused for persistence and lateral movement. Initial access vectors commonly cited in reporting on similar groups include phishing, exploitation of public-facing applications, and valid credential abuse.

Because no verified tooling list exists for this specific campaign, defenders should treat the above as general tradecraft context rather than confirmed indicators. Detection guidance for INC Ransom activity typically emphasizes monitoring for unusual RMM installations, anomalous authentication events, and large outbound data transfers.

Alleged Data Exposure

The threat actor claims to possess data belonging to Harbor Pacific. No data samples, file listings, or proof-of-leak artifacts have been publicly confirmed. The claimed data volume is undisclosed. Yazoul Security has not reviewed, downloaded, or validated any allegedly stolen material, and we will not link to or reproduce it.

Potential Impact

If the claim is accurate, a construction firm of this size could face operational disruption, project delays, contractual penalties, and exposure of internal business records. Construction and critical infrastructure contractors often hold sensitive project documentation, client communications, and engineering data. However, given the unverified nature of the claim, the actual scope of any exposure remains unknown.

What to Watch For

• Official statements from Harbor Pacific or its representatives.
• Any regulatory filings or breach notifications in Washington, Oregon, or Alaska.
• Corroborating reporting from incident response firms or law enforcement.
• Changes to the leak site entry, which often signal ongoing negotiation.

Disclaimer

This report is based solely on an unverified claim published by a ransomware group. Yazoul Security has not independently confirmed the breach, the data theft, or the accuracy of any details. Ransomware actors routinely exaggerate or fabricate claims. Treat this information as a lead for further monitoring, not as established fact.