Ingersoll Rand

What was taken

Ransom note

Published by the group on their leak site, reproduced verbatim.

Six months ago we warned the company
We are in possession of a complete archive of your software and hardware ecosystem: INSIGHTqc, INSIGHTqcx, QX/QE/QM/ICS packages, controller firmware, eMMC/Linux images, Windows installers, fieldbus configuration files, Hilscher/SYCONnet/netX tooling, and all associated deployment materials.
We had direct access to your internal configuration management systems and, over a defined period, made changes to equipment settings that are deployed on the production lines of major automotive manufacturers and in the aerospace industry.
1. Your equipment is used on the assembly lines of key automotive industry players. Volkswagen: Ingersoll Rand is a Preferred Partner, with equipment installed at the Chattanooga, Tennessee plant. BMW: Centac C400 compressors supplied to BMW's production line.
General Motors: Supplier Quality Excellence Award recipient for 4 consecutive years. Nissan: direct technical integration via the Nissan EOR Out protocol in INSIGHTqc. Ford: directly confirmed in the Global Supplier Quality Manual.
2. The scale of your presence in the automotive industry extends beyond the brands listed above. Your solutions are used in the supply chain for battery production by companies including Tesla, Nissan, and Jaguar.
This means your equipment is embedded in critical nodes of the supply chains for the entire electric vehicle sector.
3. Your business has deep ties to the U.S. defense sector.
Ingersoll Rand is an official supplier to the U.S. Department of Defense.
You have active contracts with critical military infrastructure facilities. U.S. Army: In April 2026, a tender was announced for the supply and installation of your compressor system for Rock Island Arsenal, Joint Manufacturing and Technology Center, a key U.S. Army production complex. U.S. Navy: In May 2026, a tender was announced for the procurement of your compressor for USNS Henry J. Kaiser, a U.S. Navy vessel. U.S. Air Force: In July 2026, a tender was issued for the procurement of two of your compressors for aircraft maintenance at Altus AFB.
4. Your equipment also serves the global aerospace industry. The QX Series is used for assembling fuselages, wings, and landing gear of aircraft. Any compromised settings pose direct risks to the quality of aircraft assembly.
In the automotive industry, an error in torque settings can result in the recall of hundreds of thousands of vehicles. In the last two years alone, recalls due to improper bolt tightening have been announced by Ford: 180,000 Bronco and Ranger (seat bolts). Honda: more than 46,000 Civic units in the UK and more than 406,000 Civic units in the US, as well as thousands of Passport and Pilot units. Volvo: XC60. Kia: EV9 (25,000 vehicles). Mazda: CX-50. Porsche: thousands of sports cars. VW: Tiguan, Atlas, ID.4. BMW: X5, Rolls-Royce Cullinan.
In aviation, the cost of error is even higher: it involves the lives of hundreds of people and a reputational catastrophe comparable to the Boeing 737 MAX crisis.
Automaker Responses to Quality Issues:
Ford, in May 2026, announced a policy of public exposure and no bid lists for suppliers with quality problems. Suppliers with quality issues are barred from bidding on new contracts, publicly named, and can be replaced.
Volkswagen requires suppliers to have a certified cybersecurity management system and strict compliance with Formel Q Konkret. BMW requires immediate error notification and applies escalation measures up to and including contract termination. General Motors requires compliance with IATF 16949 and PPAP.
If automakers or aviation regulators (FAA, EASA) learn that your equipment configurations could have been compromised, they will not investigate the details. They will apply their stringent measures. For Ingersoll Rand, this means loss of Preferred Partner status with Volkswagen, loss of contracts with Ford, BMW, GM, Nissan, public exposure by Ford, multi-billion-dollar collective lawsuits from automakers, investigation by the FAA and EASA, loss of defense contracts with the U.S. Department of Defense, and reputational catastrophe in the aerospace industry.
29,122 29,122 views Aug 17
DataBase Leaked
https://fex.net/s/f61fepb
29,175 29,175 views Aug 17
The files will be published after the timer counts down. The company still has time to get in touch with us
https://fex.net/s/f61fepb
32,090 32,090 views Jul 22
irco.com 118 GB Database
The IRCO archive contains 118 GB of data.
The data is organized around industrial tooling software, embedded controller packages, product releases, firmware, Windows installers, USB and eMMC deployment images, industrial communication files, fieldbus tools, driver packages, customer/demo builds, manuals, support utilities, engineering files and development/project materials.
1. Product and Release Coverage
The archive contains several product and release families:
- INSIGHTqc releases;
- INSIGHTqcx releases;
- InsightQCD Multi releases;
- InsightQCX MTC releases;
- InsightQCX2000 MTC releases;
- QX Series packages;
- QE / QM / QX Series ICS USB packages;
- ICDM controller software packages;
- IC-PCM software packages;
- MCE packages;
- QX Display firmware;
- QX Wireless firmware;
- INSIGHT Connect application packages;
- WiFi application packages;
- EOR Export and tightening-data utilities;
- fieldbus and industrial-network configuration packages;
- INSIGHTqc QC Profinet production package.
The release structure is built around engineering releases, production releases, global releases, customer builds, demo packages, field-trial packages, support packages and embedded device deployment packages.
2. Engineering Releases
The engineering release area contains firmware, installers, controller packages, field-trial materials and customer-specific technical packages.
The BRP Field Trial package contains:
- bootloader.hex;
- ICSInstaller.exe;
- qx_irdisplay.hex;
- qx_mce.out;
- qx_risc.irb;
- temp.hex;
- Viper PCM Fieldbus Data IO.xls.
This package combines a Windows installer, display firmware, MCE output, RISC package and fieldbus data file.
The engineering release area also contains INSIGHTqcx packages, MTC packages, QCD Multi packages, QX / QE / QM packages, customer demo packages and manufacturer-specific folders for Nikola, Nissan, Norbar, Parker, Mercury Marine, Volvo and VW.
3. INSIGHTqc Releases
The archive contains multiple INSIGHTqc release branches.
The INSIGHTqc branch includes:
- INSIGHTqc Version 6.4.5;
- INSIGHTqc Version 6.5.0;
- INSIGHTqc Version 6.6.0;
- INSIGHTqc Version 6.7.0;
- INSIGHTqc Version 6.8.5;
- INSIGHTqc Version 6.8.7;
- INSIGHTqc Version 7.0.6;
- INSIGHTqc Version 7.0.10;
- INSIGHTqc Version 7.0.11;
- INSIGHTqc Version 7.0.17;
- Leoardo 7.0.12;
- older INSIGHTqc Version 6 packages;
- INSIGHTqc QC Profinet production package.
INSIGHTqc packages contain application IRB files, MCE packages, downgrade packages, USB image folders, release notes, eMMC image packages, boot files, device-tree files, initramfs files, FPGA binaries, Linux kernel image files, Profinet package materials and ESSE runtime components.
Named files include:
- INSIGHTqc_6_4_5.irb;
- INSIGHTqc_6_5_0.irb;
- ESSE_PP_6_6_0.irb;
- ESSE_PP_6_7_0.irb;
- ESSE_PP_6_8_5.irb;
- ESSE_PP_6_8_7.irb;
- ESSE_PP_007_000_006.irb;
- ESSE_PP_007_000_010.irb;
- ESSE_PP_007_000_011.irb;
- ESSE_PP_007_000_017.irb;
- packageMCE / packageMce IRB files;
- downgrade IRB files.
4. INSIGHTqcx Releases
The INSIGHTqcx release branch contains versioned application packages and USB deployment packages.
The archive contains:
- Version 1.0.1;
- Version 1.0.5;
- Version 1.1.6;
- Version 1.2.2;
- Version 2.0.0;
- Version 2.0.1;
- Version 2.0.7;
- Version 2.0.10;
- Version 2.0.13;
- Version 2.0.19;
- Version 2.0.27;
- Version 2.0.37.
INSIGHTqcx Version 2.0.19 contains commercial release notes, application package 2_0_19_package.irb, USB deployment files, emmcimage.tar.bz2, blast.sh, env.txt, tsinit, tsinit.ub, device-tree files, initramfs, ts4900-fpga.bin and zImage.
The newer INSIGHTqcx branch includes Version 2.0.27 with release notes and 2_0_27_package.irb, and Version 2.0.37 with an application package.
5. Production Releases
The production release area contains QEQM-QX / ICS USB packages.
Production packages include:
- QEQM-QX Series ICS USB Package 1.2.0;
- QEQM-QX Series ICS USB Package 1.4.15;
- QEQM-QX Series ICS USB Package 1.4.20;
- QEQM-QX Series USB Package 1.4.10.
QEQM-QX Series ICS USB Package 1.2.0 contains:
- ICSInstaller.exe;
- VersionInfo.txt;
- EOR Data Acquisition.xls;
- Tightening Curve Acquisition.xls;
- IC-PCM software;
- qx_risc.irb;
- IC

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

Note

The files will be published after the timer counts down.

links

["https://fex.net/s/f61fepb"]

Credentials

ftp.irco.com:indtechcustomer:1ndCu5t; ftp.irco.com:assoftwareread:4&4erum6?a

credentials

["ftp.irco.com:indtechcustomer:1ndCu5t", "ftp.irco.com:assoftwareread:4&4erum6?a"]

Data_archives

IRCO archive contains 118 GB of data

Data_structure

The data is organized around industrial tooling software, embedded controller packages, product releases, firmware, Windows installers, USB and eMMC deployment images, industrial communication files, fieldbus tools, driver packages, customer/demo builds, manuals, support utilities, engineering files and development/project materials.

Data_base_excerpt

The IRCO archive contains 118 GB of data.

DataBase Leaked link

https://fex.net/s/f61fepb

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

Click to enlarge

ThreatCluster capture

Click to enlarge

onion leak page11 KB

Click to enlarge

Logo featuring a green circle with a stylized white design resembling a leaf or droplet.

onion leak page7.4 KB

Click to enlarge

Logo of Ingersoll Rand featuring the letters "IR" in red with the full name below in a smaller font.

onion leak page11 KB

Click to enlarge

Logo of Keysight Technologies featuring a red waveform graphic and the company name in white text.

onion leak page128 KB

Click to enlarge

onion leak page11 KB

Click to enlarge

Logo featuring the text "mansfield" in a stylized font, with "FAMILY DENTISTRY" below it.

onion leak page1.4 KB

Click to enlarge

Logo featuring a stylized letter "P" in orange with a black play button icon integrated into the design.

onion leak page7.5 KB

Click to enlarge

onion leak page5.8 KB

Click to enlarge

Logo featuring the text "Al-Futtaim" in blue, with "automotive" in a smaller font below it, accompanied by a geometric symbol.

onion leak page5.6 KB

Click to enlarge

The image features a logo with stylized figures in orange and blue, representing people, alongside the text "ALZONE" in blue.

onion leak page7.0 KB