The incransom ransomware group listed Sarulla Operation on its data leak site on 2025-11-11. Country: ID Sector: Energy & Utilities Domains named: sarullaoperations.com Claim as published on the leak site: Administration Financial operations Budgets and account balances User information Confidential information Over 1,000 passports Payment instructions and other accounting documents Contract discussions and final contracts and others