Attack alert: inc ransom targets glasserstv.com - US

Introduction

On December 20, 2025, the ransomware group inc ransom claimed responsibility for a cyberattack against glasserstv.com, an American TV and streaming service distributor employing between 10 and 50 people. This compromise, classified as SIGNAL level by our XC-Classify protocol, exposes a player in the Media & Entertainment sector that is particularly vulnerable due to its customer base, premium content, and sensitive financial data. The incident occurs amid a surge in attacks targeting content distribution platforms in the United States, a sector where ransomware exploits operational criticality to maximize pressure on victims.

The attack against glasserstv.com illustrates inc ransom's strategy targeting small and medium-sized businesses (SMBs) in the digital entertainment industry, organizations often ill-equipped to face sophisticated cybercriminal threats. The compromise of a TV/streaming distributor presents multidimensional risks: potential exposure of subscriber data, compromise of licensed content, and disruption of broadcast services. This intrusion is part of a trend observed at the end of 2025, where malicious actors intensify their operations before holiday periods, when victims' response capabilities are reduced.

Analyse détaillée

The public claim of responsibility on the inc ransom leak site confirms the double extortion model: encryption of systems coupled with the prior exfiltration of sensitive data. For glasserstv.com, this exposure represents not only an immediate operational risk but also significant regulatory implications with regard to the US legal framework on the protection of personal data and intellectual property.

Analysis of the inc ransom group: tactics and victimology of the cybercriminal collective

Inc ransom has established itself as an active ransomware actor, primarily targeting North American small and medium-sized businesses since its emergence. The group operates according to a systematic double extortion model, exfiltrating data before encryption to maximize the financial pressure on victims. This approach transforms each incident into an existential threat for compromised organizations, combining operational paralysis with significant reputational risk.

Inc ransomware's modus operandi favors classic initial access vectors: exploiting unpatched vulnerabilities in internet-exposed systems, compromising poorly secured RDP accounts, and launching targeted phishing campaigns against employees. Once the network is infiltrated, attackers deploy reconnaissance tools to map the infrastructure, identify critical assets, and locate backups before initiating encryption.

Inc ransomware's victimology reveals an opportunistic strategy focused on high-value sectors with limited cybersecurity resources. The group regularly targets the Media & Entertainment, healthcare, professional services, and retail industries. This selection reflects a cost-benefit analysis: organizations possess valuable sensitive data, have a strong operational dependence on digital systems, but often have insufficient security budgets to detect and block sophisticated intrusions.

Incransomware claims on its leak infrastructure demonstrate a sustained pace of attacks throughout 2025. The group maintains constant pressure on its victims through public ultimatums and the gradual release of exfiltrated data. This intimidation tactic aims to force rapid payments, exploiting fears of regulatory and reputational repercussions. Analysis of previous incidents suggests the group favors ransoms between $50,000 and $500,000, adjusted according to the size and perceived financial capacity of the target.

Glasserstv.com: Profile of a US TV/Streaming Distributor Under Pressure

Glasserstv.com operates in the highly competitive US television and streaming service distribution segment. With a staff of 10 to 50 employees, the organization represents a typical SME in the Media & Entertainment sector, combining operational agility with structural vulnerability to advanced cyber threats. The TV/streaming distributor business model involves managing extensive customer databases, hosting or distributing licensed content, and processing recurring financial transactions.

The nature of glasserstv.com's business generates a wealth of information that is particularly attractive to ransomware actors. Customer databases typically contain login credentials, bank details, consumption history, and viewing preferences. Premium content represents direct commercial value, and its anticipated leakage could cause financial damage to rights holders and jeopardize contractual relationships. Internal financial and operational data also constitute sensitive assets, the public exposure of which could affect the company's competitiveness.

The size of the organization (10-50 employees) suggests likely limited cybersecurity resources. SMEs in the Media & Entertainment sector often face a budgetary dilemma: investing in broadcast infrastructure and content acquisition versus strengthening defensive capabilities. This structural constraint creates opportunities for attackers, who identify these organizations as high-value, low-resilience targets. The frequent absence of a dedicated Security Operations Center (SOC) or an in-house incident response team prolongs intrusion detection time, allowing attackers to establish deep persistence before discovery.

The US location of glasserstv.com means exposure to the federal and state data protection regulatory framework. Breach notification laws vary by state but generally impose strict disclosure obligations on affected individuals and relevant authorities. For a distributor potentially managing tens of thousands of subscribers, a personal data breach triggers complex and costly legal obligations, regardless of whether or not a ransom is paid.

SIGNAL Exposure Level: Compromise Analysis and XC-Classify Methodology

The SIGNAL classification assigned to this attack by our XC-Classify protocol indicates a public claim with no visible exposed data at the time of analysis. This level corresponds to the initial pressure phase in the double extortion model: Inc. ransom announces the compromise on its leak infrastructure, thus establishing the threat's credibility without immediately disclosing the exfiltrated data. This strategy gives the victim a window of opportunity to negotiate before escalating to partial or total disclosure.

The absence of publicly accessible data does not diminish the severity of the incident for glasserstv.com. Analysis of Inc. ransom's tactics reveals that the group systematically exfiltrates significant volumes of information before encryption. For a TV/streaming distributor, this potentially involves the compromise of entire customer databases (logins, emails, payment information), system configuration files revealing the technical architecture, contractual documents with content providers, and internal financial data. The exact volume remains undetermined without access to the evidence provided by the attackers.

The XC-Classify methodology assesses criticality across several dimensions: the nature of the exposed data, the volume of accessible information, the level of sector sensitivity, and the potential regulatory impact. The SIGNAL level reflects an active but not yet publicly disclosed threat, a situation requiring continuous monitoring to detect any escalation to the MINIMAL, PARTIAL, or FULL levels. Our automated monitoring system tracks leak infrastructure daily to identify any data releases related to glasserstv.com.

Conclusion

The incident timeline begins with the initial compromise of the glasserstv.com network, the precise date of which remains unknown but likely precedes the claim of responsibility on December 20, 2025, by several weeks. The attackers exploited this period to establish persistence, map the network, identify critical assets, and exfiltrate the targeted data. The encryption of the systems and the public claim of responsibility mark the final phase of the attack, at which point Inc. Ransom reveals its presence and initiates negotiations. The organization now has a limited time (usually 7 to 14 days depending on the group's practices) to respond before the publication of evidence or complete data.