incransom
Also known as: Inc RansomFirst seen August 9, 2023Active999 claimed victims
The claims below are reproduced as posted by incransom on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europe, having posted over 200 victims in 2025 alone with no sector off-limits.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| svlawus.com | December 18, 2025 | ransomware_live | — |
| bclawoffices.com | December 18, 2025 | ransomware_live | — |
| CVK Hotels & Resorts_Turkey | December 17, 2025 | ransomware_live | — |
| Precise Benefits Group LLC | December 16, 2025 | ransomware_live | — |
| stignatiusijamsville.org | December 16, 2025 | ransomware_live | — |
| shawhillprimaryschool.org.uk | December 16, 2025 | ransomware_live | — |
| City of Cloverdale | December 14, 2025 | ransomware_live | — |
| beycelik | December 13, 2025 | ransomware_live | — |
| www.hfplanners.com | December 12, 2025 | ransomware_live | — |
| Wolf & Sofsky GmbH | December 10, 2025 | ransomware_live | — |
| rainbowtel.net | December 10, 2025 | ransomware_live | — |
| Silicon Integrated Systems | December 9, 2025 | ransomware_live | — |
| YAZAKI Corp | December 7, 2025 | ransomware_live | — |
| Foxconn Interconnect Technology Limited (FIT) | December 7, 2025 | ransomware_live | — |
| www.mylawcompany.com | December 6, 2025 | ransomware_live | — |
| bennett.edu | December 5, 2025 | ransomware_live | — |
| www.precipiodx.com | December 2, 2025 | ransomware_live | — |
| www.enea.com | December 1, 2025 | ransomware_live | — |
| oxfordshop.com.au | December 1, 2025 | ransomware_live | — |
| American Pools & Spas | December 1, 2025 | ransomware_live | — |
| steelworksinc.ca | November 29, 2025 | ransomware_live | — |
| cityofsignalhill.org | November 28, 2025 | ransomware_live | — |
| PFMI | November 27, 2025 | ransomware_live | — |
| ITL Systemhaus | November 26, 2025 | ransomware_live | — |
| FIT | November 26, 2025 | ransomware_live | — |
| Schmidt's | November 25, 2025 | ransomware_live | — |
| omegatoolcorp.com | November 24, 2025 | ransomware_live | — |
| Southern Lion Sdn Bhd | November 24, 2025 | ransomware_live | — |
| cryopur.com | November 24, 2025 | ransomware_live | — |
| TBTEAM | November 22, 2025 | ransomware_live | — |
| Woom GmbH | November 21, 2025 | ransomware_live | — |
| sandiegowarroom.com | November 20, 2025 | ransomware_live | — |
| naffco.com | November 19, 2025 | ransomware_live | — |
| zadroinc.com | November 18, 2025 | ransomware_live | — |
| https://avenira.com/ | November 17, 2025 | ransomware_live | — |
| www.northcroftme.com | November 14, 2025 | ransomware_live | — |
| Kaan Cronenberg & Partners Law | November 14, 2025 | ransomware_live | — |
| duboiswood.com | November 13, 2025 | ransomware_live | — |
| facadeinnovations.com.au | November 13, 2025 | ransomware_live | — |
| instyle.com.au | November 13, 2025 | ransomware_live | — |
| Wiraswasta Gemilang | November 12, 2025 | ransomware_live | — |
| forensicmed.com | November 12, 2025 | ransomware_live | — |
| bridge-housing-corp | November 12, 2025 | ransomware_live | — |
| latamlex (gyg.local) | November 12, 2025 | ransomware_live | — |
| KohaFoods Hawaii | November 12, 2025 | ransomware_live | — |
| www.modcomedia.com | November 11, 2025 | ransomware_live | — |
| Sarulla Operation | November 11, 2025 | ransomware_live | — |
| Weintraub Traub Tracy & Virk Cra's LLP | November 10, 2025 | ransomware_live | — |
| Community Unit School District 201 | November 10, 2025 | ransomware_live | — |
| onsolve.com | November 10, 2025 | ransomware_live | — |
| vviewisd.net | November 10, 2025 | ransomware_live | — |
| www.integer.net | November 10, 2025 | ransomware_live | — |
| hohmartin.org | November 9, 2025 | ransomware_live | — |
| The Union League of Philadelphia | November 6, 2025 | ransomware_live | — |
| zebra.or.at | November 6, 2025 | ransomware_live | — |
| elektroanlagen | November 6, 2025 | ransomware_live | — |
| pmsp.at | November 6, 2025 | ransomware_live | — |
| MusikComputer GmbH | November 6, 2025 | ransomware_live | — |
| prutsch-ra.at | November 6, 2025 | ransomware_live | — |
| Ketat Grundstücksverwertungs GmbH | November 6, 2025 | ransomware_live | — |
| REPECHAGE | November 3, 2025 | ransomware_live | — |
| Vitalmex | November 3, 2025 | ransomware_live | — |
| afton.loc | November 3, 2025 | ransomware_live | — |
| bisonfamilymedical.com | November 3, 2025 | ransomware_live | — |
| VZW Avalon | October 31, 2025 | ransomware_live | — |
| aa-llp.com (aa.law) | October 31, 2025 | ransomware_live | — |
| TMF Logistics | October 31, 2025 | ransomware_live | — |
| Evolve Mortgage Services | October 30, 2025 | ransomware_live | — |
| DILOSA FOOD COMPANIES | October 29, 2025 | ransomware_live | — |
| Alios Finance Group | October 28, 2025 | ransomware_live | — |
| dwgra.com | October 26, 2025 | ransomware_live | — |
| auge.com | October 25, 2025 | ransomware_live | — |
| Kumwell | October 22, 2025 | ransomware_live | — |
| ripleyacademy.org | October 22, 2025 | ransomware_live | — |
| grandeprairie.org | October 19, 2025 | ransomware_live | — |
| reidhurstnagy.com | October 19, 2025 | ransomware_live | — |
| Shadrix & Parmer, P.C. | October 17, 2025 | ransomware_live | — |
| continuumindia.com | October 17, 2025 | ransomware_live | — |
| baisyaakov.ca | October 17, 2025 | ransomware_live | — |
| rosemontexpo.com | October 15, 2025 | ransomware_live | — |
| datenlotsen.de | October 15, 2025 | ransomware_live | — |
| kellylegal.com.au | October 14, 2025 | ransomware_live | — |
| eakas.com | October 13, 2025 | ransomware_live | — |
| Balfour Beatty | October 12, 2025 | ransomware_live | — |
| georgetown-brewing-co | October 9, 2025 | ransomware_live | — |
| wafergrind.com | October 8, 2025 | ransomware_live | — |
| UAE Pro League | October 7, 2025 | ransomware_live | — |
| stalkerradar.com | October 5, 2025 | ransomware_live | — |
| hillsidelibrary.org | October 5, 2025 | ransomware_live | — |
| terex | October 5, 2025 | ransomware_live | — |
| Cobra Rolamentos e Autopeças | October 5, 2025 | ransomware_live | — |
| sensationalteeth.com | October 5, 2025 | ransomware_live | — |
| avrind.com | October 4, 2025 | ransomware_live | — |
| Cholakyan Chiropractic | October 1, 2025 | ransomware_live | — |
| icc-nw.net | October 1, 2025 | ransomware_live | — |
| Climatron | October 1, 2025 | ransomware_live | — |
| suntreeinternalmedicine.com | October 1, 2025 | ransomware_live | — |
| partitio.com | September 30, 2025 | ransomware_live | — |
| phi.ca | September 29, 2025 | ransomware_live | — |
| Nacsworld.com | September 29, 2025 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).