Panama’s Ministry of Economy and Finance Hit by INC Ransom

The INC Ransom group has claimed responsibility for a cyberattack on Panama’s Ministry of Economy and Finance (MEF), alleging the exfiltration of over 1.5 terabytes of sensitive data.

The stolen trove reportedly includes internal emails, confidential documents, budgetary files, and more, with the group threatening further public leaks if ministry officials do not make contact.

The ransomware group published a preview of the stolen documents on its dark web leak site and attributed a supposed financial impact of $7.5 million to the incident. As of this writing, INC Ransom has already released a small batch of files, including what appear to be internal correspondence, administrative documents, and financial records, all seemingly belonging to the Panamanian government.

The Ministry of Economy and Finance responded on September 9, 2025, confirming the detection of a malware-related incident on a single workstation. According to the ministry’s official statement, security protocols were activated immediately upon detection, and additional preventive measures were deployed across its infrastructure. The MEF emphasized that its core systems and platforms remain uncompromised and fully operational.

The ministry also reaffirmed its commitment to data protection, citing ongoing internal audits and security policy reinforcements conducted by its specialized IT team. At this time, there is no official confirmation regarding the scale of the breach or the validity of INC Ransom’s claims.

The Ministry of Economy and Finance is a central institution in the Panamanian government responsible for formulating fiscal policy, managing public finances, and overseeing the national budget. A breach of this magnitude could expose sensitive communications and strategic planning data that may have long-term implications for governance and economic stability.

INC Ransom is an aggressive ransomware-as-a-service (RaaS) operator that emerged in 2023. The group is known for targeting public institutions, educational entities, and private enterprises, with a pattern of publishing stolen data in stages to pressure victims into paying ransoms. Its leaks often include a mix of sensitive business data, personal information, and internal documentation.

While the MEF has not publicly acknowledged whether ransomware was involved, the INC Ransom posting aligns with the time of the disclosure.