incransom
Also known as: Inc RansomFirst seen August 9, 2023Active999 claimed victims
The claims below are reproduced as posted by incransom on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europe, having posted over 200 victims in 2025 alone with no sector off-limits.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| ATMS | August 7, 2026 | ransomware_live | — |
| vprj.org | August 5, 2026 | ransomware_live | — |
| https://geleximco.vn/ | August 4, 2026 | ransomware_live | — |
| lccgroup.com | August 4, 2026 | ransomware_live | — |
| pushidrosal.id | August 4, 2026 | ransomware_live | — |
| TRULITE GLASS & ALUMINUM SOLUTIONS | August 4, 2026 | ransomware_live | — |
| Loyalist College | August 4, 2026 | ransomware_live | — |
| lantisnet.com | August 4, 2026 | ransomware_live | — |
| Oleoductos del Valle | August 3, 2026 | ransomware_live | — |
| clintonhealthaccess.org | August 3, 2026 | ransomware_live | — |
| ecfa.org | August 2, 2026 | ransomware_live | — |
| quantinuum.com | August 1, 2026 | ransomware_live | — |
| sslf.local | July 30, 2026 | ransomware_live | — |
| harwal.net | July 29, 2026 | ransomware_live | — |
| foundationstofreedom.org | July 28, 2026 | ransomware_live | — |
| greenecountyga.gov | July 28, 2026 | ransomware_live | — |
| DUCON | July 28, 2026 | ransomware_live | — |
| minigrip.com.mx | July 28, 2026 | ransomware_live | — |
| Della Casa Group AG | July 28, 2026 | ransomware_live | — |
| https://eclmn.com/ | July 28, 2026 | ransomware_live | — |
| takethehop.com | July 27, 2026 | ransomware_live | — |
| healthlawadvocates.org | July 25, 2026 | ransomware_live | — |
| autismuslink.ch | July 24, 2026 | ransomware_live | — |
| cabincreekhealth.com | July 23, 2026 | ransomware_live | — |
| Ali-Monde | July 19, 2026 | ransomware_live | — |
| V&P Nurseries | July 18, 2026 | ransomware_live | — |
| reatile.co.za | July 18, 2026 | ransomware_live | — |
| pokka.co | July 18, 2026 | ransomware_live | — |
| vedan corp | July 18, 2026 | ransomware_live | — |
| D.MAG New Material Technology Co., Ltd. Taiwan Giant | July 18, 2026 | ransomware_live | — |
| FAST.COM.PH | July 18, 2026 | ransomware_live | — |
| v-silicon.com | July 18, 2026 | ransomware_live | — |
| https://www.statebankofnauvoo.com/ | July 16, 2026 | ransomware_live | — |
| asa-international.com | July 16, 2026 | ransomware_live | — |
| Kyokuto Kaihatsu Kogyo | July 16, 2026 | ransomware_live | — |
| VantagePoint Management & Autoclear | July 13, 2026 | ransomware_live | — |
| Golden Glasko & Associates | July 13, 2026 | ransomware_live | — |
| Wavecrest HFA | July 7, 2026 | ransomware_live | — |
| samberger24.de | July 6, 2026 | ransomware_live | — |
| tecnocurva.com.br | July 6, 2026 | ransomware_live | — |
| Aesthetic Surgical Images | July 6, 2026 | ransomware_live | — |
| https://www.roundshield.com/ | July 1, 2026 | ransomware_live | — |
| Colorado Rehabilitation and Occupational Medicine | July 1, 2026 | ransomware_live | — |
| hamilton-eye.com | July 1, 2026 | ransomware_live | — |
| ezortea.com.br | July 1, 2026 | ransomware_live | — |
| carvalima.com.br | July 1, 2026 | ransomware_live | — |
| acworth-ga.gov | July 1, 2026 | ransomware_live | — |
| tricountyhs.org | July 1, 2026 | ransomware_live | — |
| tambasa.com | July 1, 2026 | ransomware_live | — |
| https://sza.it/ | June 30, 2026 | ransomware_live | — |
| horizoneye.com | June 30, 2026 | ransomware_live | — |
| GDN AR(Dorinka) | June 29, 2026 | ransomware_live | — |
| theswansonlawgroup.com | June 26, 2026 | ransomware_live | — |
| johndufourlaw.com | June 26, 2026 | ransomware_live | — |
| callhorton.com | June 26, 2026 | ransomware_live | — |
| GSP Crop Science Pvt | June 25, 2026 | ransomware_live | — |
| Life Bridges | June 25, 2026 | ransomware_live | — |
| belpointeasset.com \ belpointe.com | June 22, 2026 | ransomware_live | — |
| oakparkmi.gov | June 22, 2026 | ransomware_live | — |
| jktornel | June 21, 2026 | ransomware_live | — |
| Newspaper Media Group | June 20, 2026 | ransomware_live | — |
| Horizon Family Medical Group | June 18, 2026 | ransomware_live | — |
| neuwoges.de | June 17, 2026 | ransomware_live | — |
| jasperplastics.info | June 16, 2026 | ransomware_live | — |
| smithassociatescpa.com | June 15, 2026 | ransomware_live | — |
| fineconsulting | June 11, 2026 | ransomware_live | — |
| DISCOLABINDU | June 11, 2026 | ransomware_live | — |
| Signazon_USA | June 11, 2026 | ransomware_live | — |
| Kewaunee Scientific | June 11, 2026 | ransomware_live | — |
| FIZA | June 10, 2026 | ransomware_live | — |
| kelmreuter.com | June 6, 2026 | ransomware_live | — |
| obrieneng.com | June 5, 2026 | ransomware_live | — |
| pdcbodynits | June 4, 2026 | ransomware_live | — |
| Stuga Machinery | June 4, 2026 | ransomware_live | — |
| Oztugotomotiv | June 3, 2026 | ransomware_live | — |
| CUSTOMSIGN | June 3, 2026 | ransomware_live | — |
| Champaign-Urbana Public Health District | June 1, 2026 | ransomware_live | — |
| Bradley law firm | June 1, 2026 | ransomware_live | — |
| Colina Financial Advisors | June 1, 2026 | ransomware_live | — |
| www.labexpress.com | May 29, 2026 | ransomware_live | — |
| lawants | May 28, 2026 | ransomware_live | — |
| belimed.com | May 28, 2026 | ransomware_live | — |
| trrac.net | May 28, 2026 | ransomware_live | — |
| Distrigaz Vest S.A. | May 27, 2026 | ransomware_live | — |
| Open Door Health Center | May 25, 2026 | ransomware_live | — |
| PILLER AIMMCO | May 25, 2026 | ransomware_live | — |
| Mecanizados y Montajes Aeronáuticos (mymgroup.es) | May 23, 2026 | ransomware_live | — |
| threadinnovations | May 22, 2026 | ransomware_live | — |
| framesiprofessional.com | May 22, 2026 | ransomware_live | — |
| Nothing | May 19, 2026 | ransomware_live | — |
| metaval.com.au | May 17, 2026 | ransomware_live | — |
| United Quality Cooperative / www.uqcoop.com | May 15, 2026 | ransomware_live | — |
| lafj.org | May 15, 2026 | ransomware_live | — |
| defenseisready.com | May 15, 2026 | ransomware_live | — |
| Silergy Corp | May 13, 2026 | ransomware_live | — |
| Bideawee | May 11, 2026 | ransomware_live | — |
| rbh aerospace inc | May 11, 2026 | ransomware_live | — |
| lopezlawfl.com | May 10, 2026 | ransomware_live | — |
| https://sibillacapital.com/ | May 10, 2026 | ransomware_live | — |
| lalsgroup.com | May 10, 2026 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).