incransom
Also known as: Inc RansomFirst seen August 9, 2023Active951 claimed victims
The claims below are reproduced as posted by incransom on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europe, having posted over 200 victims in 2025 alone with no sector off-limits.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Conveyors, Inc. | March 30, 2026 | ransomware_live | — |
| barrypgoldberg.com | March 30, 2026 | ransomware_live | — |
| millersteelelaw.com | March 30, 2026 | ransomware_live | — |
| domingogarcia.com | March 30, 2026 | ransomware_live | — |
| Greenology Products | March 29, 2026 | ransomware_live | — |
| bergen1.net | March 29, 2026 | ransomware_live | — |
| morgancountyga.gov | March 28, 2026 | ransomware_live | — |
| bdac.com.au | March 28, 2026 | ransomware_live | — |
| www.durable-tech.com | March 28, 2026 | ransomware_live | — |
| www.davidhelfandlaw.com | March 26, 2026 | ransomware_live | — |
| glenmarkpharma.com | March 25, 2026 | ransomware_live | — |
| pulpdent.com | March 25, 2026 | ransomware_live | — |
| ETFSA | March 25, 2026 | ransomware_live | — |
| jenningsk12.org | March 24, 2026 | ransomware_live | — |
| cerboniservices.com | March 24, 2026 | ransomware_live | — |
| PWNA Plains | March 24, 2026 | ransomware_live | — |
| JDV Products | March 23, 2026 | ransomware_live | — |
| Kiswire | March 23, 2026 | ransomware_live | — |
| airports.com.na | March 19, 2026 | ransomware_live | — |
| rxm.com.au | March 19, 2026 | ransomware_live | — |
| mcquaidinjurylaw.com | March 16, 2026 | ransomware_live | — |
| Kentucky Injury | March 11, 2026 | ransomware_live | — |
| thethibeauxfirm.com | March 11, 2026 | ransomware_live | — |
| Estra Automotive | March 10, 2026 | ransomware_live | — |
| Teknopres_TR | March 10, 2026 | ransomware_live | — |
| LHT Holdings Limited | March 10, 2026 | ransomware_live | — |
| Meirc training and consulting | March 10, 2026 | ransomware_live | — |
| tupeloeye.com | March 9, 2026 | ransomware_live | — |
| altaortho.com | March 9, 2026 | ransomware_live | — |
| roodtrucking.com | March 8, 2026 | ransomware_live | — |
| arbd.com | March 6, 2026 | ransomware_live | — |
| parkerlipman.com | March 5, 2026 | ransomware_live | — |
| cwpa.com | March 4, 2026 | ransomware_live | — |
| The City of Hesperia, CA | March 4, 2026 | ransomware_live | — |
| piglerautomation.com | March 4, 2026 | ransomware_live | — |
| www.chrishudsonlaw.com | March 3, 2026 | ransomware_live | — |
| Hopkins Law | March 3, 2026 | ransomware_live | — |
| Hersher Law | March 3, 2026 | ransomware_live | — |
| Brockman Injury Lawyer | March 3, 2026 | ransomware_live | — |
| Law Offices of Mark E. Lewis & Associates | March 3, 2026 | ransomware_live | — |
| Napolin Law Firm | March 3, 2026 | ransomware_live | — |
| napolinlaw.com | March 3, 2026 | ransomware_live | — |
| hopkins-law.com | March 3, 2026 | ransomware_live | — |
| lawofficesoferichershler.com | March 3, 2026 | ransomware_live | — |
| brockmaninjurylawyer.com | March 3, 2026 | ransomware_live | — |
| northstaria.com | March 3, 2026 | ransomware_live | — |
| Martin, Cukjati & Tom, LLP | March 2, 2026 | ransomware_live | — |
| mcfirm.com | March 2, 2026 | ransomware_live | — |
| frazercenter.org | March 2, 2026 | ransomware_live | — |
| VLawyers | March 2, 2026 | ransomware_live | — |
| abramssales.com | March 1, 2026 | ransomware_live | — |
| http://ramet-trom.co.il/ | February 28, 2026 | ransomware_live | — |
| Law Offices Taenzer & Ettenson, P.C. (tesalaw.com) | February 27, 2026 | ransomware_live | — |
| Lymphedema Therapy Specialists | February 27, 2026 | ransomware_live | — |
| irpea.it | February 27, 2026 | ransomware_live | — |
| Tract Consulting | February 26, 2026 | ransomware_live | — |
| Empresa de Transportes Via Pajuçara Ltda. | February 26, 2026 | ransomware_live | — |
| APRO Asian Protection Pte Ltd | February 25, 2026 | ransomware_live | — |
| WE Fitness | February 25, 2026 | ransomware_live | — |
| https://daricon.com/ | February 25, 2026 | ransomware_live | — |
| https://daricon.com/ (military US/CA/NATO) | February 25, 2026 | ransomware_live | — |
| Rainier Clinical Research Center | February 23, 2026 | ransomware_live | — |
| The City of Cocoa | February 23, 2026 | ransomware_live | — |
| TESTCOMPANY | February 21, 2026 | ransomware_live | — |
| polymedicure.com | February 20, 2026 | ransomware_live | — |
| Valgo SA | February 19, 2026 | ransomware_live | — |
| meridenct.gov | February 18, 2026 | ransomware_live | — |
| farbank.com (flywatertravel) | February 17, 2026 | ransomware_live | — |
| Hiwassee Builder Supply | February 17, 2026 | ransomware_live | — |
| Ondine Biomedical | February 16, 2026 | ransomware_live | — |
| ACS Accountancy | February 16, 2026 | ransomware_live | — |
| Nang Kuang Pharmaceutical Co., Ltd. | February 15, 2026 | ransomware_live | — |
| acwapower.com \ https://www.larsentoubro.com/ | February 15, 2026 | ransomware_live | — |
| Bitgo | February 14, 2026 | ransomware_live | — |
| primepak.com | February 13, 2026 | ransomware_live | — |
| lohmann-tapes.com | February 12, 2026 | ransomware_live | — |
| rswater.ae | February 12, 2026 | ransomware_live | — |
| Midwestern Oil & Gas | February 12, 2026 | ransomware_live | — |
| auxhomeservices.com | February 11, 2026 | ransomware_live | — |
| Core Supply | February 10, 2026 | ransomware_live | — |
| tuftco | February 9, 2026 | ransomware_live | — |
| aircotedivoire.com | February 6, 2026 | ransomware_live | — |
| AOT Japan | February 5, 2026 | ransomware_live | — |
| lke-group.com | February 4, 2026 | ransomware_live | — |
| Western New York Energy | February 3, 2026 | ransomware_live | — |
| saturnmachine.net | February 3, 2026 | ransomware_live | — |
| csi-ri.com | February 3, 2026 | ransomware_live | — |
| www.pucobre.cl | February 2, 2026 | ransomware_live | — |
| ChokChey Finance | February 2, 2026 | ransomware_live | — |
| H-Behbehani Brothers WLL | February 2, 2026 | ransomware_live | — |
| Foamtec International | February 1, 2026 | ransomware_live | — |
| Blystone & Bailey | February 1, 2026 | ransomware_live | — |
| Beacon Mutual Insurance | January 31, 2026 | ransomware_live | — |
| Hawk Law Group | January 31, 2026 | ransomware_live | — |
| pacepacific.com | January 31, 2026 | ransomware_live | — |
| DIEHL & CELLA ADVOGADOS ASSOCIADOS | January 30, 2026 | ransomware_live | — |
| PK PINHÃO & KOIFFMAN ATTORNEYS AT LAW | January 30, 2026 | ransomware_live | — |
| denmark.k12.wi.us | January 29, 2026 | ransomware_live | — |
| DeRenzis & Associates | January 28, 2026 | ransomware_live | — |
| LGBTQ Center Orange county | January 28, 2026 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).