Ransomware: incransom claims quantinuum.com (US) — Technology

On August 1, 2026, the ransomware group Incransom claimed responsibility for an attack against Quantinuum, a U.S.-based quantum computing technology firm. The claim was published on the ransomware.live data leak site, which tracks such incidents. While the posting does not confirm data exfiltration or encryption, the claim itself signals a potential breach of systems that may hold sensitive research, intellectual property, and client data. Under the EU Cyber Resilience Act (CRA), this incident highlights the growing risk to digital products and services, particularly in advanced technology sectors where supply chain dependencies are high.

The primary affected organization is Quantinuum, but the impact extends to its enterprise clients, research partners, and any downstream users of its quantum computing services. Because the CRA applies to products with digital elements placed on the EU market, any hardware, software, or cloud services linked to Quantinuum could fall under its obligations. Other technology firms in the quantum, AI, and high-performance computing space should also treat this as a warning, as they face similar threat profiles.

Compliance teams should immediately verify whether any of their vendors or partners rely on Quantinuum systems and assess contractual notification duties. They should also review their own incident response plans against CRA requirements, particularly regarding vulnerability reporting and timely disclosure to authorities. Finally, teams should monitor the ransomware.live page for any leaked data and prepare to activate breach notification procedures if evidence of compromised personal or commercial data emerges. This is a moment to reinforce supply chain due diligence and ensure that CRA-aligned security patches and risk assessments are current.