incransom
Also known as: Inc RansomFirst seen August 9, 2023Active999 claimed victims
The claims below are reproduced as posted by incransom on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europe, having posted over 200 victims in 2025 alone with no sector off-limits.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Aerodiagnostics | May 6, 2026 | ransomware_live | — |
| EXPEDITOR | May 5, 2026 | ransomware_live | — |
| sanver.com.mx | May 4, 2026 | ransomware_live | — |
| earthsystems.com.au earthsystemseurope.com | May 3, 2026 | ransomware_live | — |
| https://www.wilkemgroup.com/ | May 2, 2026 | ransomware_live | — |
| northshoreenv.com | May 1, 2026 | ransomware_live | — |
| autorisk.org | May 1, 2026 | ransomware_live | — |
| cmswpc.com | May 1, 2026 | ransomware_live | — |
| Arban & Carosi | April 30, 2026 | ransomware_live | — |
| nbd3pl.com | April 29, 2026 | ransomware_live | — |
| Iowa Spring Manufacturing & Sales | April 29, 2026 | ransomware_live | — |
| Selex - Gruppo Commerciale | April 27, 2026 | ransomware_live | — |
| egnyte.com | April 27, 2026 | ransomware_live | — |
| MTCI | April 26, 2026 | ransomware_live | — |
| BELFOR | April 26, 2026 | ransomware_live | — |
| krauseundco | April 25, 2026 | ransomware_live | — |
| Dorotea Sweden | April 24, 2026 | ransomware_live | — |
| tlctrialteam.com | April 24, 2026 | ransomware_live | — |
| krwlawyers.com | April 22, 2026 | ransomware_live | — |
| rheem | April 20, 2026 | ransomware_live | — |
| Mag. Fünder Hausverwaltungs GmbH | April 17, 2026 | ransomware_live | — |
| childplace.org | April 17, 2026 | ransomware_live | — |
| alupco.com | April 13, 2026 | ransomware_live | — |
| Straten & Kollegen | April 12, 2026 | ransomware_live | — |
| www.campbell.edu | April 11, 2026 | ransomware_live | — |
| mastercom.com.au | April 11, 2026 | ransomware_live | — |
| https://www.fulcrumre.com/ | April 11, 2026 | ransomware_live | — |
| Kannarr Eye Care | April 10, 2026 | ransomware_live | reported in press coverage |
| wright-ryan.com | April 10, 2026 | ransomware_live | — |
| reddycardiology.com | April 10, 2026 | ransomware_live | — |
| teamster773.org | April 8, 2026 | ransomware_live | — |
| pacificwestinjury.com | April 7, 2026 | ransomware_live | — |
| Community Connections | April 4, 2026 | ransomware_live | — |
| sumacinc.com | April 4, 2026 | ransomware_live | — |
| BERGE-BAU GmbH & Co. KG | April 3, 2026 | ransomware_live | — |
| coronapa.com | April 3, 2026 | ransomware_live | — |
| bgcsnv.org | April 2, 2026 | ransomware_live | — |
| Lincoln Property LLC | April 1, 2026 | ransomware_live | — |
| Infonet Media d.o.o. | April 1, 2026 | ransomware_live | — |
| martek co ltd. | April 1, 2026 | ransomware_live | — |
| treelawoffice.com | April 1, 2026 | ransomware_live | — |
| submissionfinance.com | March 31, 2026 | ransomware_live | — |
| delapazlaw.com | March 31, 2026 | ransomware_live | — |
| Conveyors, Inc. | March 30, 2026 | ransomware_live | — |
| barrypgoldberg.com | March 30, 2026 | ransomware_live | — |
| millersteelelaw.com | March 30, 2026 | ransomware_live | — |
| domingogarcia.com | March 30, 2026 | ransomware_live | — |
| Greenology Products | March 29, 2026 | ransomware_live | — |
| bergen1.net | March 29, 2026 | ransomware_live | — |
| morgancountyga.gov | March 28, 2026 | ransomware_live | — |
| bdac.com.au | March 28, 2026 | ransomware_live | — |
| www.durable-tech.com | March 28, 2026 | ransomware_live | — |
| www.davidhelfandlaw.com | March 26, 2026 | ransomware_live | — |
| glenmarkpharma.com | March 25, 2026 | ransomware_live | — |
| pulpdent.com | March 25, 2026 | ransomware_live | — |
| ETFSA | March 25, 2026 | ransomware_live | — |
| jenningsk12.org | March 24, 2026 | ransomware_live | — |
| cerboniservices.com | March 24, 2026 | ransomware_live | — |
| PWNA Plains | March 24, 2026 | ransomware_live | — |
| JDV Products | March 23, 2026 | ransomware_live | — |
| Kiswire | March 23, 2026 | ransomware_live | — |
| airports.com.na | March 19, 2026 | ransomware_live | — |
| rxm.com.au | March 19, 2026 | ransomware_live | — |
| mcquaidinjurylaw.com | March 16, 2026 | ransomware_live | — |
| Kentucky Injury | March 11, 2026 | ransomware_live | — |
| thethibeauxfirm.com | March 11, 2026 | ransomware_live | — |
| Estra Automotive | March 10, 2026 | ransomware_live | — |
| Teknopres_TR | March 10, 2026 | ransomware_live | — |
| LHT Holdings Limited | March 10, 2026 | ransomware_live | — |
| Meirc training and consulting | March 10, 2026 | ransomware_live | — |
| tupeloeye.com | March 9, 2026 | ransomware_live | — |
| altaortho.com | March 9, 2026 | ransomware_live | — |
| roodtrucking.com | March 8, 2026 | ransomware_live | — |
| arbd.com | March 6, 2026 | ransomware_live | — |
| parkerlipman.com | March 5, 2026 | ransomware_live | — |
| cwpa.com | March 4, 2026 | ransomware_live | — |
| The City of Hesperia, CA | March 4, 2026 | ransomware_live | — |
| piglerautomation.com | March 4, 2026 | ransomware_live | — |
| www.chrishudsonlaw.com | March 3, 2026 | ransomware_live | — |
| Hopkins Law | March 3, 2026 | ransomware_live | — |
| Hersher Law | March 3, 2026 | ransomware_live | — |
| Brockman Injury Lawyer | March 3, 2026 | ransomware_live | — |
| Law Offices of Mark E. Lewis & Associates | March 3, 2026 | ransomware_live | — |
| Napolin Law Firm | March 3, 2026 | ransomware_live | — |
| napolinlaw.com | March 3, 2026 | ransomware_live | — |
| hopkins-law.com | March 3, 2026 | ransomware_live | — |
| lawofficesoferichershler.com | March 3, 2026 | ransomware_live | — |
| brockmaninjurylawyer.com | March 3, 2026 | ransomware_live | — |
| northstaria.com | March 3, 2026 | ransomware_live | — |
| Martin, Cukjati & Tom, LLP | March 2, 2026 | ransomware_live | — |
| mcfirm.com | March 2, 2026 | ransomware_live | — |
| frazercenter.org | March 2, 2026 | ransomware_live | — |
| VLawyers | March 2, 2026 | ransomware_live | — |
| abramssales.com | March 1, 2026 | ransomware_live | — |
| http://ramet-trom.co.il/ | February 28, 2026 | ransomware_live | — |
| Law Offices Taenzer & Ettenson, P.C. (tesalaw.com) | February 27, 2026 | ransomware_live | — |
| Lymphedema Therapy Specialists | February 27, 2026 | ransomware_live | — |
| irpea.it | February 27, 2026 | ransomware_live | — |
| Tract Consulting | February 26, 2026 | ransomware_live | — |
| Empresa de Transportes Via Pajuçara Ltda. | February 26, 2026 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).