Skip to content
Leak-site post naming pharma5.ma, captured by ThreatCluster

pharma5.ma

incransom

Ransomware leak-site victim intelligence · EN

Data size
50Gb
Views
3,140
Posted
Sep 25, 2026
Country
Morocco
Industry
Healthcare

Summary

Written by ThreatClusterfrom file listing, victim profile, leak post, screenshot

Incransom claims to have leaked 50Gb of data from Pharma5 (pharma5.ma) in Morocco, including corporate and financial information, data on products and their supply, quality control and certification, drug testing issues, employee personal data, and counterparties. The leak post is published on the group's site. The leak page identifies Pharma5 as the victim (domain pharma5.ma, Morocco).

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

Victim profile

Domains
pharma5.ma

What was taken

Leaked data: 50Gb Corporate and financial information, data on products and their supply, quality control and certification, drug testing and related issues, employee personal data, counterparties, and much more.

Data categories
Corporate and financial informationdata on products and their supplyquality control and certificationdrug testing and related issuesemployee personal datacounterparties

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

Leaked data: 50Gb Corporate and financial information, data on products and thei
present

Leak-site images (1)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture