incransom
Also known as: Inc RansomFirst seen August 9, 2023Active999 claimed victims
The claims below are reproduced as posted by incransom on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europe, having posted over 200 victims in 2025 alone with no sector off-limits.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| P&P Industries | September 23, 2025 | ransomware_live | — |
| TLD Law.com | September 23, 2025 | ransomware_live | — |
| CPK Interior | September 22, 2025 | ransomware_live | — |
| Speed Art Museum | September 22, 2025 | ransomware_live | — |
| Znojma Czechia | September 22, 2025 | ransomware_live | — |
| Pennsylvania Office of Attorney General | September 21, 2025 | ransomware_live | — |
| https://www.cnh.com/ | September 16, 2025 | ransomware_live | — |
| Humax Holdings | September 16, 2025 | ransomware_live | — |
| jsgroup | September 15, 2025 | ransomware_live | — |
| Technology Assurance Group | September 15, 2025 | ransomware_live | — |
| https://heritagegrowth.com/ | September 14, 2025 | ransomware_live | — |
| http://www.hiec.com/ | September 14, 2025 | ransomware_live | — |
| www.roscovision.com | September 14, 2025 | ransomware_live | — |
| galileo.it | September 12, 2025 | ransomware_live | — |
| www.melenco.com | September 10, 2025 | ransomware_live | — |
| transnova-ruf.de | September 10, 2025 | ransomware_live | — |
| deerfield.com / singulargenomics.com | September 10, 2025 | ransomware_live | — |
| BRIGHT SYSTEM JAPAN CO., LTD | September 10, 2025 | ransomware_live | — |
| Miesa | September 9, 2025 | ransomware_live | — |
| Republica De Panama | September 9, 2025 | ransomware_live | — |
| CBL-SRL | September 5, 2025 | ransomware_live | — |
| Easterseals Arc of Northeast Indiana | September 5, 2025 | ransomware_live | — |
| Grupo Via Argentina | September 5, 2025 | ransomware_live | — |
| Monterey Mushrooms, LLC | September 4, 2025 | ransomware_live | — |
| Venlogistics | September 4, 2025 | ransomware_live | — |
| stockmeier-urethanes.com | September 4, 2025 | ransomware_live | — |
| stthom.edu | September 3, 2025 | ransomware_live | — |
| CANDhenterprises.com | September 3, 2025 | ransomware_live | — |
| sandg.local | September 3, 2025 | ransomware_live | — |
| CESCONSULT | September 2, 2025 | ransomware_live | — |
| Commission scolaire des Appalaches | September 2, 2025 | ransomware_live | — |
| baronespecialtysteel.com | September 2, 2025 | ransomware_live | — |
| TAK Communications, Inc | September 1, 2025 | ransomware_live | — |
| Bartek Ingredients | September 1, 2025 | ransomware_live | — |
| cardiofocus.com | August 31, 2025 | ransomware_live | — |
| www.sbdl.net | August 29, 2025 | ransomware_live | — |
| OB GYN Associates | August 29, 2025 | ransomware_live | — |
| Manjarrez Impresores | August 29, 2025 | ransomware_live | — |
| callhci.com | August 29, 2025 | ransomware_live | — |
| Chapter 13 Texas | August 29, 2025 | ransomware_live | — |
| Benedict Industries | August 29, 2025 | ransomware_live | — |
| Kafka Conveyors & Equipment Inc | August 28, 2025 | ransomware_live | — |
| idealbathrooms.ie | August 27, 2025 | ransomware_live | — |
| awo-ka-land.de | August 26, 2025 | ransomware_live | — |
| NextGen Mold Technologies | August 26, 2025 | ransomware_live | — |
| Security First Credit Union | August 25, 2025 | ransomware_live | — |
| marlboroughpartners.com | August 25, 2025 | ransomware_live | — |
| Quadrangle Imaging Center | August 22, 2025 | ransomware_live | — |
| LAMMCO.NET | August 22, 2025 | ransomware_live | — |
| summitgolfbrands.com | August 22, 2025 | ransomware_live | — |
| CPK Interior Products Inc | August 21, 2025 | ransomware_live | — |
| https://www.tongapower.to/ | August 21, 2025 | ransomware_live | — |
| BDO Perú | August 20, 2025 | ransomware_live | — |
| WELLSLANDSCAPING.COM | August 19, 2025 | ransomware_live | — |
| schuler-service-group.de | August 13, 2025 | ransomware_live | — |
| lindenlaw.com | August 13, 2025 | ransomware_live | — |
| EUROFILM ΜΑΝΤΖΑΡΗΣ Α.Ε | August 12, 2025 | ransomware_live | — |
| Louis Tieu DDS MD | August 11, 2025 | ransomware_live | — |
| cardinal-services.com | August 10, 2025 | ransomware_live | — |
| Afpa | August 6, 2025 | ransomware_live | — |
| Carrollton Ear Nose and Throat | August 5, 2025 | ransomware_live | — |
| thevisapro.com (Yibirin Law Group) | August 4, 2025 | ransomware_live | — |
| omegabiotek.com | August 1, 2025 | ransomware_live | — |
| Devon | July 31, 2025 | ransomware_live | — |
| Radford City Schools | July 31, 2025 | ransomware_live | — |
| Dollar Tree | July 30, 2025 | ransomware_live | — |
| fsl.org | July 30, 2025 | ransomware_live | — |
| cphcorp.com | July 29, 2025 | ransomware_live | — |
| Manesa | July 25, 2025 | ransomware_live | — |
| www.lincecomercial.com | July 24, 2025 | ransomware_live | — |
| www.labiennale.org | July 24, 2025 | ransomware_live | — |
| www.entecheng.com | July 24, 2025 | ransomware_live | — |
| TOMEI GROUP Inc. | July 22, 2025 | ransomware_live | — |
| www.reliablecontrols.com | July 22, 2025 | ransomware_live | — |
| multichem.net | July 22, 2025 | ransomware_live | — |
| dtxstudio.com | July 21, 2025 | ransomware_live | — |
| reizenlaw.com | July 21, 2025 | ransomware_live | — |
| nboat.com | July 20, 2025 | ransomware_live | — |
| mycpaconnection.com | July 20, 2025 | ransomware_live | — |
| Secountryvets_AU | July 17, 2025 | ransomware_live | — |
| TERENCE C RINGLAND & CO PTY LTD | July 17, 2025 | ransomware_live | — |
| Vitec | July 17, 2025 | ransomware_live | — |
| Huize Sint-Augustinus_BE | July 17, 2025 | ransomware_live | — |
| HTC_Högtryckscenter_Sweden | July 17, 2025 | ransomware_live | — |
| climaxportable.com | July 17, 2025 | ransomware_live | — |
| CF Construction Ltd | July 15, 2025 | ransomware_live | — |
| National Institute of Water Resources | July 14, 2025 | ransomware_live | — |
| Trilinklogistics Inc / Leacked by www.etornetworks.com/ | July 14, 2025 | ransomware_live | — |
| lstlaw.ca/ Leaked by www.etornetworks.com | July 14, 2025 | ransomware_live | — |
| dwllp.ca/ Leaked by www.etornetworks.com | July 14, 2025 | ransomware_live | — |
| www.v4ulogistic.com/ Leaked by www.etornetworks.com | July 14, 2025 | ransomware_live | — |
| Otjiwarongo Municipality | July 14, 2025 | ransomware_live | — |
| Universal Group For Engineering and Consulting | July 14, 2025 | ransomware_live | — |
| ocmaine.com | July 11, 2025 | ransomware_live | — |
| Tec Imports | July 10, 2025 | ransomware_live | — |
| bayviewci.org | July 10, 2025 | ransomware_live | — |
| Lamberts Business Systems | July 9, 2025 | ransomware_live | — |
| TBC | July 8, 2025 | ransomware_live | — |
| tsaworld.com | July 7, 2025 | ransomware_live | — |
| asi-group.com | July 7, 2025 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).