incransom
Also known as: Inc RansomFirst seen August 9, 2023Active951 claimed victims
The claims below are reproduced as posted by incransom on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europe, having posted over 200 victims in 2025 alone with no sector off-limits.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| myglobal.com | September 3, 2026 | ransomware_live | — |
| myglobal.com | September 3, 2026 | ransomlook | — |
| Metales Panamericanos | September 2, 2026 | ransomlook | — |
| Multiver Ltée | September 2, 2026 | ransomlook | — |
| Policlinico Triestino | September 2, 2026 | ransomlook | — |
| Trucka | September 2, 2026 | ransomlook | — |
| Westfield Public School District | September 2, 2026 | ransomlook | — |
| Asfaltos y Pavimentos S.A. (Asfalpasa) | September 2, 2026 | ransomlook | — |
| specialtytextile.com | September 2, 2026 | ransomlook | — |
| specialtytextile.com | September 1, 2026 | ransomware_live | — |
| Metales Panamericanos | September 1, 2026 | ransomware_live | — |
| Multiver Ltée | September 1, 2026 | ransomware_live | — |
| Policlinico Triestino | September 1, 2026 | ransomware_live | — |
| Trucka | September 1, 2026 | ransomware_live | — |
| Westfield Public School District | September 1, 2026 | ransomware_live | — |
| Asfaltos y Pavimentos S.A. (Asfalpasa) | September 1, 2026 | ransomware_live | — |
| cimbsecurities.com | August 31, 2026 | ransomware_live | — |
| www.renorefractories.com | August 31, 2026 | ransomware_live | — |
| www.lichtvision.com | August 31, 2026 | ransomware_live | — |
| zummocorp.com | August 31, 2026 | ransomware_live | — |
| New Century Ophthalmology Group | August 31, 2026 | ransomware_live | — |
| New Century Ophthalmology Group | August 31, 2026 | ransomlook | — |
| FFKR Architects | August 31, 2026 | ransomlook | — |
| cimbsecurities.com | August 31, 2026 | ransomlook | — |
| www.renorefractories.com | August 31, 2026 | ransomlook | — |
| www.lichtvision.com | August 31, 2026 | ransomlook | — |
| zummocorp.com | August 31, 2026 | ransomlook | — |
| wittmann | August 29, 2026 | ransomware_live | — |
| wittmann | August 29, 2026 | ransomlook | — |
| Oilquip Inc | August 29, 2026 | ransomlook | — |
| Oilquip Inc | August 28, 2026 | ransomware_live | — |
| Ruby Seven Studios | August 27, 2026 | ransomware_live | — |
| Rohloff Group | August 27, 2026 | ransomware_live | — |
| BENCIVIL | August 27, 2026 | ransomware_live | — |
| Ruby Seven Studios | August 27, 2026 | ransomlook | — |
| Rohloff Group | August 27, 2026 | ransomlook | — |
| BENCIVIL | August 27, 2026 | ransomlook | — |
| el-group | August 22, 2026 | ransomware_live | — |
| EXEL | August 19, 2026 | ransomware_live | — |
| CDGARVINLAW | August 19, 2026 | ransomware_live | — |
| UNIPLASTICS.COM | August 19, 2026 | ransomware_live | — |
| BANGKOKCABLE | August 19, 2026 | ransomware_live | — |
| Third Coast Bancshares | August 18, 2026 | ransomware_live | — |
| SD Associates Sdn Bhd | August 18, 2026 | ransomware_live | — |
| Foresee Pharmaceuticals | August 18, 2026 | ransomware_live | — |
| nyklawfirm.com nyk.ae | August 18, 2026 | ransomware_live | — |
| ssf-int.com ssf-ing.de | August 18, 2026 | ransomware_live | — |
| SpearFin Ltd | August 18, 2026 | ransomware_live | — |
| Lansing Urgent Care | August 16, 2026 | ransomware_live | — |
| cambrialawfirm.com | August 13, 2026 | ransomware_live | — |
| https://pacific-construction.com/ | August 13, 2026 | ransomware_live | — |
| stuartandassociates.com | August 12, 2026 | ransomware_live | — |
| diabetesandmetabolism.com | August 12, 2026 | ransomware_live | — |
| BEDC.COM.AU | August 12, 2026 | ransomware_live | — |
| gamaus.com | August 12, 2026 | ransomware_live | — |
| clgroup | August 12, 2026 | ransomware_live | — |
| Otter Tail County, Minnesota | August 11, 2026 | ransomware_live | — |
| Louisville Bar Association | August 8, 2026 | ransomware_live | — |
| ATMS | August 7, 2026 | ransomware_live | — |
| vprj.org | August 5, 2026 | ransomware_live | — |
| https://geleximco.vn/ | August 4, 2026 | ransomware_live | — |
| lccgroup.com | August 4, 2026 | ransomware_live | — |
| pushidrosal.id | August 4, 2026 | ransomware_live | — |
| TRULITE GLASS & ALUMINUM SOLUTIONS | August 4, 2026 | ransomware_live | — |
| Loyalist College | August 4, 2026 | ransomware_live | — |
| lantisnet.com | August 4, 2026 | ransomware_live | — |
| Oleoductos del Valle | August 3, 2026 | ransomware_live | — |
| clintonhealthaccess.org | August 3, 2026 | ransomware_live | — |
| ecfa.org | August 2, 2026 | ransomware_live | — |
| quantinuum.com | August 1, 2026 | ransomware_live | — |
| sslf.local | July 30, 2026 | ransomware_live | — |
| harwal.net | July 29, 2026 | ransomware_live | — |
| foundationstofreedom.org | July 28, 2026 | ransomware_live | — |
| greenecountyga.gov | July 28, 2026 | ransomware_live | — |
| DUCON | July 28, 2026 | ransomware_live | — |
| minigrip.com.mx | July 28, 2026 | ransomware_live | — |
| Della Casa Group AG | July 28, 2026 | ransomware_live | — |
| https://eclmn.com/ | July 28, 2026 | ransomware_live | — |
| takethehop.com | July 27, 2026 | ransomware_live | — |
| healthlawadvocates.org | July 25, 2026 | ransomware_live | — |
| autismuslink.ch | July 24, 2026 | ransomware_live | — |
| cabincreekhealth.com | July 23, 2026 | ransomware_live | — |
| Ali-Monde | July 19, 2026 | ransomware_live | — |
| V&P Nurseries | July 18, 2026 | ransomware_live | — |
| reatile.co.za | July 18, 2026 | ransomware_live | — |
| pokka.co | July 18, 2026 | ransomware_live | — |
| vedan corp | July 18, 2026 | ransomware_live | — |
| D.MAG New Material Technology Co., Ltd. Taiwan Giant | July 18, 2026 | ransomware_live | — |
| FAST.COM.PH | July 18, 2026 | ransomware_live | — |
| v-silicon.com | July 18, 2026 | ransomware_live | — |
| https://www.statebankofnauvoo.com/ | July 16, 2026 | ransomware_live | — |
| asa-international.com | July 16, 2026 | ransomware_live | — |
| Kyokuto Kaihatsu Kogyo | July 16, 2026 | ransomware_live | — |
| VantagePoint Management & Autoclear | July 13, 2026 | ransomware_live | — |
| Golden Glasko & Associates | July 13, 2026 | ransomware_live | — |
| samberger24.de | July 6, 2026 | ransomware_live | — |
| tecnocurva.com.br | July 6, 2026 | ransomware_live | — |
| Aesthetic Surgical Images | July 6, 2026 | ransomware_live | — |
| https://www.roundshield.com/ | July 1, 2026 | ransomware_live | — |
| Colorado Rehabilitation and Occupational Medicine | July 1, 2026 | ransomware_live | — |
Page 1 of 10Older →
Claim data from ransomware.live and RansomLook (CC BY 4.0).