INC Ransom Breaches Mastercom, Leaks Sensitive Data from Australian Communications Firm The INC Ransom hacking group has claimed responsibility for a cyberattack on Mastercom, a Granville, New South Wales-based communications provider, and published stolen internal and customer data on its darknet leak site. The breach was first disclosed on April 11, with the threat actors alleging they exfiltrated customer records, HR documents, and financial data. In subsequent leaks, INC Ransom released a full dataset that also included information from Queensland Communications, a company acquired by Mastercom in 2013. The exposed files contained sensitive details, such as fault reports, internal building layouts, photos of cable infrastructure, and locations of communications equipment for over 100 customers. Mastercom acknowledged the incident in a brief statement, confirming awareness of the breach but declining further comment. Hamish Duff, Mastercom’s Managing Director, stated that the company had taken steps in response but provided no additional details. ### About INC Ransom Active since 2023, INC Ransom operates under a ransomware-as-a-service (RaaS) model, leasing its malware to affiliates in exchange for a share of ransom payments. The group has claimed 760 victims globally, with a growing focus on Australian targets, particularly in healthcare and professional services. According to the Australian Cyber Security Centre (ACSC), INC Ransom has been linked to 11 reported incidents in Australia between July 2024 and December 2025, primarily affecting healthcare entities. The group typically gains access via compromised accounts, escalates privileges, and deploys malicious files (e.g., win.exe) before exfiltrating sensitive data, including personally identifiable and medical information. Mastercom’s recent breach follows another attack on the Bendigo & District Aboriginal Co-operative, which was listed alongside Mastercom on INC Ransom’s leak site. ### About Mastercom Mastercom provides communications services to critical sectors, including transport & logistics, local government, emergency services, and airports & ports. The company operates the Orion Network, Australia’s largest commercial two-way radio network, serving clients such as Newcastle, Maitland, and Penrith City Councils, as well as state and federal police, SES, and fire services. The breach raises concerns over the exposure of operational and infrastructure data, potentially impacting emergency response and public safety communications.