incransom
Also known as: Inc RansomFirst seen August 9, 2023Active951 claimed victims
The claims below are reproduced as posted by incransom on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europe, having posted over 200 victims in 2025 alone with no sector off-limits.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Black Butte Coal Co | January 29, 2024 | ransomware_live | — |
| OrthoNY, Orthopedic Care | January 25, 2024 | ransomware_live | — |
| Sykes Consulting, Inc. | January 19, 2024 | ransomware_live | — |
| Washington School For The Deaf | January 12, 2024 | ransomware_live | — |
| CellNetix Pathology & Laboratories, LLC | January 8, 2024 | ransomware_live | — |
| Xerox Corp | December 29, 2023 | ransomware_live | — |
| Unite Here | December 20, 2023 | ransomware_live | — |
| New York School of Interior Design | December 16, 2023 | ransomware_live | — |
| King Aerospace, Inc. | December 12, 2023 | ransomware_live | — |
| Tri-city Medical Center | December 7, 2023 | ransomware_live | — |
| Precision Technologies Group Ltd | December 7, 2023 | ransomware_live | — |
| Kellett & Bartholow PLLC | December 1, 2023 | ransomware_live | — |
| Trylon TSF Inc. | November 23, 2023 | ransomware_live | — |
| Springfield Area Chamber of Commerce | November 23, 2023 | ransomware_live | — |
| Pro Metals LLC | November 23, 2023 | ransomware_live | — |
| Nicole Miller | November 23, 2023 | ransomware_live | — |
| Ingo Money Inc | November 23, 2023 | ransomware_live | — |
| DM Civil Construction Co | November 23, 2023 | ransomware_live | — |
| B+P Gerüstbau GmbH | November 23, 2023 | ransomware_live | — |
| WellLife Network Inc. | November 17, 2023 | ransomware_live | — |
| Consilium staffing llc | November 16, 2023 | ransomware_live | — |
| SCOLARI Srl | November 15, 2023 | ransomware_live | — |
| Guardian Alarm | November 15, 2023 | ransomware_live | — |
| Yamaha Motor Philippines,Inc. | November 15, 2023 | ransomware_live | — |
| Decatur Independent School District | November 15, 2023 | ransomware_live | — |
| EFU Life Assurance Ltd | November 6, 2023 | ransomware_live | — |
| Livability | November 3, 2023 | ransomware_live | — |
| Universal Sewing Supply Inc | October 31, 2023 | ransomware_live | — |
| Global Export Marketing Co. Ltd. | October 29, 2023 | ransomware_live | — |
| Alam Flora Sdn Bhd | October 27, 2023 | ransomware_live | — |
| Direct Mail Corporation | October 25, 2023 | ransomware_live | — |
| Greenpoint Technologies Inc | October 17, 2023 | ransomware_live | — |
| Cleveland City Schools | October 13, 2023 | ransomware_live | — |
| Catholic Charities | October 13, 2023 | ransomware_live | — |
| Vicon industries inc. | October 12, 2023 | ransomware_live | — |
| Sobieski | October 11, 2023 | ransomware_live | — |
| Village Building Co. | October 11, 2023 | ransomware_live | — |
| Jacobsen Construction | September 28, 2023 | ransomware_live | — |
| Agilitas IT Solutions Limited | September 22, 2023 | ransomware_live | — |
| Leoch Battery Corp | September 20, 2023 | ransomware_live | — |
| Federal Labor Relations Authority | September 20, 2023 | ransomware_live | — |
| ENTRUST Solutions Group | September 20, 2023 | ransomware_live | — |
| ************ | September 18, 2023 | ransomware_live | — |
| Elemetal | September 18, 2023 | ransomware_live | — |
| Abbeyfield | September 12, 2023 | ransomware_live | — |
| It4 Solutions Robras | September 6, 2023 | ransomware_live | — |
| I Keating Furniture World | September 6, 2023 | ransomware_live | — |
| Arkopharma | September 3, 2023 | ransomware_live | — |
| Pifer's Auction & Realty | August 31, 2023 | ransomware_live | — |
| Hemmink | August 16, 2023 | ransomware_live | — |
| Thermenhotel Stoiser | August 6, 2023 | ransomware_live | — |
← NewerPage 10 of 10
Claim data from ransomware.live and RansomLook (CC BY 4.0).