THREAT WATCH · September 29, 2026 · RANSOMWARE LISTING

South African Services Firm Listed by INCRANSOM Ransomware Group

bcx.co.za, a South African services company with more than 1,000 employees, was recorded on the INCRANSOM ransomware tracker on September 29, 2026. The listing means the organization's name and domain appear on an attacker-side leak site. It does not confirm that data was exfiltrated or that a breach occurred. The company has not yet made a public disclosure about the matter. Intel128 is tracking this event and will update as new information becomes available.

Key takeaways

• bcx.co.za was recorded on the INCRANSOM leak site on September 29, 2026.
• The company operates in the Services sector in South Africa with over 1,000 employees.
• No public disclosure has been made by the organization as of this post.
• A listing is a strong signal of potential compromise but not a confirmed breach.

What We Know

• The domain bcx.co.za was listed by the INCRANSOM group on September 29, 2026.
• The organization operates in the Services sector and is based in South Africa.
• Company size is recorded as over 1,000 employees, placing it among larger firms in its sector.
• As of the time of this post, the company has not publicly disclosed any incident or acknowledged the listing.
• No technical indicators such as file names, hashes, or specific data samples have been published alongside the listing.

About INCRANSOM

INCRANSOM is a ransomware group that operates a leak site where it publishes the names and domains of organizations it claims to have compromised. Listings on this site are treated by Intel128 as strong indicators of potential compromise but are not independently verified as confirmed breaches.

The group has been active in recording victims across multiple sectors and geographies. A listing does not necessarily mean data was stolen. It indicates that the group is asserting some form of access or leverage over the target. In some cases, listings are used as pressure tactics even when the underlying intrusion is limited or unsuccessful.

What This Means for Stakeholders

Organizations with ties to bcx.co.za should consider the following actions:

• Review third-party risk. If your company shares data or systems with this organization, assess whether any exposure exists. Map dependencies and confirm whether contractual breach-notification obligations are triggered.
• Monitor for disclosure. The company has not yet commented. A public statement may follow as the situation develops. Security teams should watch for official communications in the coming days.
• Check for credential exposure. Domains listed on ransomware trackers sometimes correlate with leaked credentials appearing elsewhere. Security teams should verify whether associated accounts show signs of compromise or unusual login activity.
• Assess sector risk. The Services sector is a frequent target for ransomware groups because of the volume of personal and operational data these firms handle. Organizations in the same sector should treat this as a reminder to validate their own defenses.

Intel128 Assessment

The listing is recorded and verified by our tracker crawl. We classify this as a high-confidence signal of potential compromise pending further evidence. The absence of a public disclosure from the company is not unusual in the early hours or days following a listing. It does not reduce the significance of the event.

We will update this post if the company issues a statement or if additional technical indicators become available through our monitoring. Organizations in the South African services sector should remain alert, as ransomware groups often target clusters of similar firms within a short window.

SOURCE: INTEL128 THREAT INTELLIGENCE FEED (UPDATED OCT 01, 2026). A listing is a record on an attacker-side ransomware tracker - strong signal, not a confirmed breach. Intel128 publishes what the feed shows and no more.