incransom
Also known as: Inc RansomFirst seen August 9, 2023Active951 claimed victims
The claims below are reproduced as posted by incransom on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europe, having posted over 200 victims in 2025 alone with no sector off-limits.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| hamilton-eye.com | July 1, 2026 | ransomware_live | — |
| ezortea.com.br | July 1, 2026 | ransomware_live | — |
| carvalima.com.br | July 1, 2026 | ransomware_live | — |
| acworth-ga.gov | July 1, 2026 | ransomware_live | — |
| tricountyhs.org | July 1, 2026 | ransomware_live | — |
| tambasa.com | July 1, 2026 | ransomware_live | — |
| https://sza.it/ | June 30, 2026 | ransomware_live | — |
| horizoneye.com | June 30, 2026 | ransomware_live | — |
| GDN AR(Dorinka) | June 29, 2026 | ransomware_live | — |
| theswansonlawgroup.com | June 26, 2026 | ransomware_live | — |
| johndufourlaw.com | June 26, 2026 | ransomware_live | — |
| callhorton.com | June 26, 2026 | ransomware_live | — |
| GSP Crop Science Pvt | June 25, 2026 | ransomware_live | — |
| Life Bridges | June 25, 2026 | ransomware_live | — |
| belpointeasset.com \ belpointe.com | June 22, 2026 | ransomware_live | — |
| oakparkmi.gov | June 22, 2026 | ransomware_live | — |
| jktornel | June 21, 2026 | ransomware_live | — |
| Newspaper Media Group | June 20, 2026 | ransomware_live | — |
| Horizon Family Medical Group | June 18, 2026 | ransomware_live | — |
| neuwoges.de | June 17, 2026 | ransomware_live | — |
| jasperplastics.info | June 16, 2026 | ransomware_live | — |
| smithassociatescpa.com | June 15, 2026 | ransomware_live | — |
| fineconsulting | June 11, 2026 | ransomware_live | — |
| DISCOLABINDU | June 11, 2026 | ransomware_live | — |
| Signazon_USA | June 11, 2026 | ransomware_live | — |
| Kewaunee Scientific | June 11, 2026 | ransomware_live | — |
| FIZA | June 10, 2026 | ransomware_live | — |
| kelmreuter.com | June 6, 2026 | ransomware_live | — |
| obrieneng.com | June 5, 2026 | ransomware_live | — |
| pdcbodynits | June 4, 2026 | ransomware_live | — |
| Stuga Machinery | June 4, 2026 | ransomware_live | — |
| Oztugotomotiv | June 3, 2026 | ransomware_live | — |
| CUSTOMSIGN | June 3, 2026 | ransomware_live | — |
| Champaign-Urbana Public Health District | June 1, 2026 | ransomware_live | — |
| Bradley law firm | June 1, 2026 | ransomware_live | — |
| Colina Financial Advisors | June 1, 2026 | ransomware_live | — |
| www.labexpress.com | May 29, 2026 | ransomware_live | — |
| lawants | May 28, 2026 | ransomware_live | — |
| belimed.com | May 28, 2026 | ransomware_live | — |
| trrac.net | May 28, 2026 | ransomware_live | — |
| Distrigaz Vest S.A. | May 27, 2026 | ransomware_live | — |
| Open Door Health Center | May 25, 2026 | ransomware_live | — |
| PILLER AIMMCO | May 25, 2026 | ransomware_live | — |
| Mecanizados y Montajes Aeronáuticos (mymgroup.es) | May 23, 2026 | ransomware_live | — |
| threadinnovations | May 22, 2026 | ransomware_live | — |
| framesiprofessional.com | May 22, 2026 | ransomware_live | — |
| Nothing | May 19, 2026 | ransomware_live | — |
| metaval.com.au | May 17, 2026 | ransomware_live | — |
| United Quality Cooperative / www.uqcoop.com | May 15, 2026 | ransomware_live | — |
| lafj.org | May 15, 2026 | ransomware_live | — |
| defenseisready.com | May 15, 2026 | ransomware_live | — |
| Silergy Corp | May 13, 2026 | ransomware_live | — |
| Bideawee | May 11, 2026 | ransomware_live | — |
| rbh aerospace inc | May 11, 2026 | ransomware_live | — |
| lopezlawfl.com | May 10, 2026 | ransomware_live | — |
| https://sibillacapital.com/ | May 10, 2026 | ransomware_live | — |
| lalsgroup.com | May 10, 2026 | ransomware_live | — |
| Aerodiagnostics | May 6, 2026 | ransomware_live | — |
| EXPEDITOR | May 5, 2026 | ransomware_live | — |
| sanver.com.mx | May 4, 2026 | ransomware_live | — |
| earthsystems.com.au earthsystemseurope.com | May 3, 2026 | ransomware_live | — |
| https://www.wilkemgroup.com/ | May 2, 2026 | ransomware_live | — |
| northshoreenv.com | May 1, 2026 | ransomware_live | — |
| autorisk.org | May 1, 2026 | ransomware_live | — |
| cmswpc.com | May 1, 2026 | ransomware_live | — |
| Arban & Carosi | April 30, 2026 | ransomware_live | — |
| nbd3pl.com | April 29, 2026 | ransomware_live | — |
| Iowa Spring Manufacturing & Sales | April 29, 2026 | ransomware_live | — |
| Selex - Gruppo Commerciale | April 27, 2026 | ransomware_live | — |
| egnyte.com | April 27, 2026 | ransomware_live | — |
| MTCI | April 26, 2026 | ransomware_live | — |
| BELFOR | April 26, 2026 | ransomware_live | — |
| krauseundco | April 25, 2026 | ransomware_live | — |
| Dorotea Sweden | April 24, 2026 | ransomware_live | — |
| tlctrialteam.com | April 24, 2026 | ransomware_live | — |
| krwlawyers.com | April 22, 2026 | ransomware_live | — |
| rheem | April 20, 2026 | ransomware_live | — |
| Mag. Fünder Hausverwaltungs GmbH | April 17, 2026 | ransomware_live | — |
| childplace.org | April 17, 2026 | ransomware_live | — |
| alupco.com | April 13, 2026 | ransomware_live | — |
| Straten & Kollegen | April 12, 2026 | ransomware_live | — |
| www.campbell.edu | April 11, 2026 | ransomware_live | — |
| mastercom.com.au | April 11, 2026 | ransomware_live | — |
| https://www.fulcrumre.com/ | April 11, 2026 | ransomware_live | — |
| Kannarr Eye Care | April 10, 2026 | ransomware_live | — |
| wright-ryan.com | April 10, 2026 | ransomware_live | — |
| reddycardiology.com | April 10, 2026 | ransomware_live | — |
| teamster773.org | April 8, 2026 | ransomware_live | — |
| pacificwestinjury.com | April 7, 2026 | ransomware_live | — |
| Community Connections | April 4, 2026 | ransomware_live | — |
| sumacinc.com | April 4, 2026 | ransomware_live | — |
| BERGE-BAU GmbH & Co. KG | April 3, 2026 | ransomware_live | — |
| coronapa.com | April 3, 2026 | ransomware_live | — |
| bgcsnv.org | April 2, 2026 | ransomware_live | — |
| Lincoln Property LLC | April 1, 2026 | ransomware_live | — |
| Infonet Media d.o.o. | April 1, 2026 | ransomware_live | — |
| martek co ltd. | April 1, 2026 | ransomware_live | — |
| treelawoffice.com | April 1, 2026 | ransomware_live | — |
| submissionfinance.com | March 31, 2026 | ransomware_live | — |
| delapazlaw.com | March 31, 2026 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).