incransom
Also known as: Inc RansomFirst seen August 9, 2023Active951 claimed victims
The claims below are reproduced as posted by incransom on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europe, having posted over 200 victims in 2025 alone with no sector off-limits.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Sarulla Operation | November 11, 2025 | ransomware_live | — |
| Weintraub Traub Tracy & Virk Cra's LLP | November 10, 2025 | ransomware_live | — |
| Community Unit School District 201 | November 10, 2025 | ransomware_live | — |
| onsolve.com | November 10, 2025 | ransomware_live | — |
| vviewisd.net | November 10, 2025 | ransomware_live | — |
| www.integer.net | November 10, 2025 | ransomware_live | — |
| hohmartin.org | November 9, 2025 | ransomware_live | — |
| The Union League of Philadelphia | November 6, 2025 | ransomware_live | — |
| zebra.or.at | November 6, 2025 | ransomware_live | — |
| elektroanlagen | November 6, 2025 | ransomware_live | — |
| pmsp.at | November 6, 2025 | ransomware_live | — |
| MusikComputer GmbH | November 6, 2025 | ransomware_live | — |
| prutsch-ra.at | November 6, 2025 | ransomware_live | — |
| Ketat Grundstücksverwertungs GmbH | November 6, 2025 | ransomware_live | — |
| REPECHAGE | November 3, 2025 | ransomware_live | — |
| Vitalmex | November 3, 2025 | ransomware_live | — |
| afton.loc | November 3, 2025 | ransomware_live | — |
| bisonfamilymedical.com | November 3, 2025 | ransomware_live | — |
| VZW Avalon | October 31, 2025 | ransomware_live | — |
| aa-llp.com (aa.law) | October 31, 2025 | ransomware_live | — |
| TMF Logistics | October 31, 2025 | ransomware_live | — |
| Evolve Mortgage Services | October 30, 2025 | ransomware_live | — |
| DILOSA FOOD COMPANIES | October 29, 2025 | ransomware_live | — |
| Alios Finance Group | October 28, 2025 | ransomware_live | — |
| dwgra.com | October 26, 2025 | ransomware_live | — |
| auge.com | October 25, 2025 | ransomware_live | — |
| Kumwell | October 22, 2025 | ransomware_live | — |
| ripleyacademy.org | October 22, 2025 | ransomware_live | — |
| grandeprairie.org | October 19, 2025 | ransomware_live | — |
| reidhurstnagy.com | October 19, 2025 | ransomware_live | — |
| Shadrix & Parmer, P.C. | October 17, 2025 | ransomware_live | — |
| continuumindia.com | October 17, 2025 | ransomware_live | — |
| baisyaakov.ca | October 17, 2025 | ransomware_live | — |
| rosemontexpo.com | October 15, 2025 | ransomware_live | — |
| datenlotsen.de | October 15, 2025 | ransomware_live | — |
| kellylegal.com.au | October 14, 2025 | ransomware_live | — |
| eakas.com | October 13, 2025 | ransomware_live | — |
| Balfour Beatty | October 12, 2025 | ransomware_live | — |
| georgetown-brewing-co | October 9, 2025 | ransomware_live | — |
| wafergrind.com | October 8, 2025 | ransomware_live | — |
| stalkerradar.com | October 5, 2025 | ransomware_live | — |
| hillsidelibrary.org | October 5, 2025 | ransomware_live | — |
| terex | October 5, 2025 | ransomware_live | — |
| Cobra Rolamentos e Autopeças | October 5, 2025 | ransomware_live | — |
| sensationalteeth.com | October 5, 2025 | ransomware_live | — |
| avrind.com | October 4, 2025 | ransomware_live | — |
| Cholakyan Chiropractic | October 1, 2025 | ransomware_live | — |
| icc-nw.net | October 1, 2025 | ransomware_live | — |
| Climatron | October 1, 2025 | ransomware_live | — |
| suntreeinternalmedicine.com | October 1, 2025 | ransomware_live | — |
| partitio.com | September 30, 2025 | ransomware_live | — |
| phi.ca | September 29, 2025 | ransomware_live | — |
| Nacsworld.com | September 29, 2025 | ransomware_live | — |
| P&P Industries | September 23, 2025 | ransomware_live | — |
| TLD Law.com | September 23, 2025 | ransomware_live | — |
| CPK Interior | September 22, 2025 | ransomware_live | — |
| Speed Art Museum | September 22, 2025 | ransomware_live | — |
| Znojma Czechia | September 22, 2025 | ransomware_live | — |
| Pennsylvania Office of Attorney General | September 21, 2025 | ransomware_live | — |
| https://www.cnh.com/ | September 16, 2025 | ransomware_live | — |
| Humax Holdings | September 16, 2025 | ransomware_live | — |
| jsgroup | September 15, 2025 | ransomware_live | — |
| Technology Assurance Group | September 15, 2025 | ransomware_live | — |
| https://heritagegrowth.com/ | September 14, 2025 | ransomware_live | — |
| http://www.hiec.com/ | September 14, 2025 | ransomware_live | — |
| www.roscovision.com | September 14, 2025 | ransomware_live | — |
| galileo.it | September 12, 2025 | ransomware_live | — |
| www.melenco.com | September 10, 2025 | ransomware_live | — |
| transnova-ruf.de | September 10, 2025 | ransomware_live | — |
| deerfield.com / singulargenomics.com | September 10, 2025 | ransomware_live | — |
| BRIGHT SYSTEM JAPAN CO., LTD | September 10, 2025 | ransomware_live | — |
| Miesa | September 9, 2025 | ransomware_live | — |
| Republica De Panama | September 9, 2025 | ransomware_live | — |
| CBL-SRL | September 5, 2025 | ransomware_live | — |
| Easterseals Arc of Northeast Indiana | September 5, 2025 | ransomware_live | — |
| Grupo Via Argentina | September 5, 2025 | ransomware_live | — |
| Monterey Mushrooms, LLC | September 4, 2025 | ransomware_live | — |
| Venlogistics | September 4, 2025 | ransomware_live | — |
| stockmeier-urethanes.com | September 4, 2025 | ransomware_live | — |
| stthom.edu | September 3, 2025 | ransomware_live | — |
| CANDhenterprises.com | September 3, 2025 | ransomware_live | — |
| sandg.local | September 3, 2025 | ransomware_live | — |
| CESCONSULT | September 2, 2025 | ransomware_live | — |
| Commission scolaire des Appalaches | September 2, 2025 | ransomware_live | — |
| baronespecialtysteel.com | September 2, 2025 | ransomware_live | — |
| TAK Communications, Inc | September 1, 2025 | ransomware_live | — |
| Bartek Ingredients | September 1, 2025 | ransomware_live | — |
| cardiofocus.com | August 31, 2025 | ransomware_live | — |
| www.sbdl.net | August 29, 2025 | ransomware_live | — |
| OB GYN Associates | August 29, 2025 | ransomware_live | — |
| Manjarrez Impresores | August 29, 2025 | ransomware_live | — |
| callhci.com | August 29, 2025 | ransomware_live | — |
| Chapter 13 Texas | August 29, 2025 | ransomware_live | — |
| Benedict Industries | August 29, 2025 | ransomware_live | — |
| Kafka Conveyors & Equipment Inc | August 28, 2025 | ransomware_live | — |
| idealbathrooms.ie | August 27, 2025 | ransomware_live | — |
| awo-ka-land.de | August 26, 2025 | ransomware_live | — |
| NextGen Mold Technologies | August 26, 2025 | ransomware_live | — |
| Security First Credit Union | August 25, 2025 | ransomware_live | — |
| marlboroughpartners.com | August 25, 2025 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).