Powered by MOMENTUMMEDIA
For breaking news and daily updates, subscribe to our newsletter

Exclusive: NSW pharmacy management firm allegedly breached by INC Ransom

Threat actors have claimed a cyber attack on a Sydney-based pharmacy management company, threatening to expose allegedly stolen data in days.

Fri, 10 Apr 2026
Exclusive: NSW pharmacy management firm allegedly breached by INC Ransom

Rx Management is an NSW-based franchise network that manages a number of pharmacy locations across NSW, Victoria, and South Australia.

“We care about the wellbeing of our customers, and our vision is to be the best in the community pharmacy, health and beauty space in Australia in dispensing prescriptions, providing health, beauty and lifestyle solutions and selling health and beauty product,” the company said in its description.

The company was listed on the dark web leak site of INC Ransom on 8 April, with the threat actor allegedly having stolen over 180 gigabytes of data.

 
 

While the threat actor did not disclose any details of the incident, it said that in just under two days at the time of writing, it intends to publish the data it claims to have exfiltrated.

Cyber Daily has reached out to Rx Management for more information and commentary on the incident and is currently awaiting a response.

Who is INC Ransom?

INC Ransom was first observed in August 2023 and has claimed 754 victims since then, making it one of the top five most active ransomware groups at the time of writing. It is a ransomware-as-a-service operation, offering its ransomware expertise to any hacker in return for a cut of any profits.

The group uses spear-phishing tactics to gain initial access and double extortion to pressure its victims – this means it exfiltrates data from a victim’s network before encrypting it in place.

The victim must then pay a ransom not only to recover the data encrypted on its own systems but also to ensure that it is not published to the darknet or sold to another threat actor.

Cyber DailyWant to see more stories from trusted news sources?
Make Cyber Daily a preferred news source on Google.

Daniel Croft

Born in the heart of Western Sydney, Daniel Croft is a passionate journalist with an understanding for and experience writing in the technology space. Having studied at Macquarie University, he joined Momentum Media in 2022, writing across a number of publications including Australian Aviation, Cyber Security Connect and Defence Connect. Outside of writing, Daniel has a keen interest in music, and spends his time playing in bands around Sydney.
Tags: