THREAT WATCH · September 24, 2026 · RANSOMWARE LISTING

US Manufacturing Firm Listed by INCRANSOM Ransomware Group

On September 24, 2026, the domain welgenone.com was recorded on the INCRANSOM ransomware tracker. The organization behind this domain operates in the United States within the manufacturing and engineering sector and employs between 51 and 100 people. As of this writing, the company has not publicly disclosed any security incident. A listing on an attacker-side tracker is a strong signal that data may have been exfiltrated and held for ransom, but it does not by itself confirm that a breach has occurred. Intel128 is monitoring the situation for further developments.

Key takeaways

• welgenone.com was recorded on the INCRANSOM tracker on September 24, 2026
• The organization is a US-based manufacturing and engineering firm with 51 to 100 employees
• No public disclosure has been made by the company as of this post
• A tracker listing is a strong signal but does not independently confirm a breach

What is known

• The domain welgenone.com appeared on the INCRANSOM tracker on September 24, 2026.
• The organization is based in the United States.
• It operates in the manufacturing and engineering sector.
• Company size is estimated at 51 to 100 employees.
• No public disclosure has been made by the organization as of this post.

About INCRANSOM

INCRANSOM is a ransomware group that publishes victim domains on its own leak site. The group typically threatens to release stolen data unless a ransom is paid. A listing on this tracker means the group claims to have obtained data from the organization. It does not independently verify that a breach occurred or that the data is genuine. Groups like INCRANSOM often target mid-sized organizations that may have limited security resources, making them attractive targets for initial access and data theft.

Why this matters for executives

• Manufacturing and engineering firms often hold sensitive design files, supplier contracts, and production schedules that are valuable to competitors or other threat actors.
• Mid-sized companies with 51 to 100 employees may lack dedicated incident response teams, which can slow detection and recovery.
• A listing on a public tracker can expose the organization to secondary threats, including phishing and social engineering from other actors who monitor these sites.

Recommended actions

• Verify internally. Check whether any unusual network activity, data transfers, or ransom notes have been observed in the relevant time window.
• Review exposure. Confirm whether the domain welgenone.com is actively used in customer-facing or supplier-facing workflows.
• Prepare communications. If a breach is confirmed, having a pre-approved communication plan reduces confusion and legal risk.
• Engage specialists. If no incident response capability exists in-house, consider retaining a firm experienced in ransomware negotiations and forensic analysis.

What Intel128 is watching

Intel128 will update this entry if the organization issues a public statement, if additional domains linked to the same entity appear on the tracker, or if INCRANSOM publishes data allegedly taken from this target.

SOURCE: INTEL128 THREAT INTELLIGENCE FEED (UPDATED OCT 01, 2026). A listing is a record on an attacker-side ransomware tracker - strong signal, not a confirmed breach. Intel128 publishes what the feed shows and no more.