incransom
Also known as: Inc RansomFirst seen August 9, 2023Active951 claimed victims
The claims below are reproduced as posted by incransom on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europe, having posted over 200 victims in 2025 alone with no sector off-limits.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Quadrangle Imaging Center | August 22, 2025 | ransomware_live | — |
| LAMMCO.NET | August 22, 2025 | ransomware_live | — |
| summitgolfbrands.com | August 22, 2025 | ransomware_live | — |
| CPK Interior Products Inc | August 21, 2025 | ransomware_live | — |
| https://www.tongapower.to/ | August 21, 2025 | ransomware_live | — |
| BDO Perú | August 20, 2025 | ransomware_live | — |
| WELLSLANDSCAPING.COM | August 19, 2025 | ransomware_live | — |
| schuler-service-group.de | August 13, 2025 | ransomware_live | — |
| lindenlaw.com | August 13, 2025 | ransomware_live | — |
| EUROFILM ΜΑΝΤΖΑΡΗΣ Α.Ε | August 12, 2025 | ransomware_live | — |
| Louis Tieu DDS MD | August 11, 2025 | ransomware_live | — |
| cardinal-services.com | August 10, 2025 | ransomware_live | — |
| Afpa | August 6, 2025 | ransomware_live | — |
| Carrollton Ear Nose and Throat | August 5, 2025 | ransomware_live | — |
| thevisapro.com (Yibirin Law Group) | August 4, 2025 | ransomware_live | — |
| omegabiotek.com | August 1, 2025 | ransomware_live | — |
| Devon | July 31, 2025 | ransomware_live | — |
| Radford City Schools | July 31, 2025 | ransomware_live | — |
| Dollar Tree | July 30, 2025 | ransomware_live | — |
| fsl.org | July 30, 2025 | ransomware_live | — |
| cphcorp.com | July 29, 2025 | ransomware_live | — |
| Manesa | July 25, 2025 | ransomware_live | — |
| www.lincecomercial.com | July 24, 2025 | ransomware_live | — |
| www.labiennale.org | July 24, 2025 | ransomware_live | — |
| www.entecheng.com | July 24, 2025 | ransomware_live | — |
| TOMEI GROUP Inc. | July 22, 2025 | ransomware_live | — |
| www.reliablecontrols.com | July 22, 2025 | ransomware_live | — |
| multichem.net | July 22, 2025 | ransomware_live | — |
| dtxstudio.com | July 21, 2025 | ransomware_live | — |
| reizenlaw.com | July 21, 2025 | ransomware_live | — |
| nboat.com | July 20, 2025 | ransomware_live | — |
| mycpaconnection.com | July 20, 2025 | ransomware_live | — |
| Secountryvets_AU | July 17, 2025 | ransomware_live | — |
| TERENCE C RINGLAND & CO PTY LTD | July 17, 2025 | ransomware_live | — |
| Vitec | July 17, 2025 | ransomware_live | — |
| Huize Sint-Augustinus_BE | July 17, 2025 | ransomware_live | — |
| HTC_Högtryckscenter_Sweden | July 17, 2025 | ransomware_live | — |
| climaxportable.com | July 17, 2025 | ransomware_live | — |
| CF Construction Ltd | July 15, 2025 | ransomware_live | — |
| National Institute of Water Resources | July 14, 2025 | ransomware_live | — |
| Trilinklogistics Inc / Leacked by www.etornetworks.com/ | July 14, 2025 | ransomware_live | — |
| lstlaw.ca/ Leaked by www.etornetworks.com | July 14, 2025 | ransomware_live | — |
| dwllp.ca/ Leaked by www.etornetworks.com | July 14, 2025 | ransomware_live | — |
| www.v4ulogistic.com/ Leaked by www.etornetworks.com | July 14, 2025 | ransomware_live | — |
| Otjiwarongo Municipality | July 14, 2025 | ransomware_live | — |
| Universal Group For Engineering and Consulting | July 14, 2025 | ransomware_live | — |
| ocmaine.com | July 11, 2025 | ransomware_live | — |
| bayviewci.org | July 10, 2025 | ransomware_live | — |
| Lamberts Business Systems | July 9, 2025 | ransomware_live | — |
| TBC | July 8, 2025 | ransomware_live | — |
| tsaworld.com | July 7, 2025 | ransomware_live | — |
| asi-group.com | July 7, 2025 | ransomware_live | — |
| Töller | July 7, 2025 | ransomware_live | — |
| C B King Memorial School(branch) | July 4, 2025 | ransomware_live | — |
| Majestic | July 4, 2025 | ransomware_live | — |
| MJets | July 4, 2025 | ransomware_live | — |
| Consumer Electronics & Computers Retail Retail | July 2, 2025 | ransomware_live | — |
| coruzcitywndata+ | July 1, 2025 | ransomware_live | — |
| Netstar_South_Africa | July 1, 2025 | ransomware_live | — |
| Сomet-strip-enterprises-ltd | June 30, 2025 | ransomware_live | — |
| erichschleichgmbh.de | June 30, 2025 | ransomware_live | — |
| Wingpoh_SG | June 29, 2025 | ransomware_live | — |
| carolynmyoung.com | June 29, 2025 | ransomware_live | — |
| allmaxnutrition.com | June 27, 2025 | ransomware_live | — |
| The Kingdom of Tonga's Ministry of Health | June 26, 2025 | ransomware_live | — |
| firstpresatl.org | June 26, 2025 | ransomware_live | — |
| Medical Center of Marin | June 25, 2025 | ransomware_live | — |
| deliastamales.com | June 25, 2025 | ransomware_live | — |
| seasonsfour.com | June 24, 2025 | ransomware_live | — |
| AFECC - Hospital Santa Rita de Cássia | June 19, 2025 | ransomware_live | — |
| teampostop.net | June 19, 2025 | ransomware_live | — |
| New Jersey Association on Correction | June 18, 2025 | ransomware_live | — |
| Durant City | June 17, 2025 | ransomware_live | — |
| Lamina Dielectrics, United Kingdom | June 17, 2025 | ransomware_live | — |
| Academic Urology & Urogynecology of Arizona | June 17, 2025 | ransomware_live | — |
| West Texas Oral and Facial Surgery | June 17, 2025 | ransomware_live | — |
| Fund for Reformed Companies (FONPER) | June 17, 2025 | ransomware_live | — |
| erniesinceresco.com | June 17, 2025 | ransomware_live | — |
| doradosoftware.com | June 16, 2025 | ransomware_live | — |
| hitachi-tds.com | June 15, 2025 | ransomware_live | — |
| Sementes Jotabasso | June 15, 2025 | ransomware_live | — |
| lynkspot.com | June 15, 2025 | ransomware_live | — |
| csaas.com | June 12, 2025 | ransomware_live | — |
| neues-leben.de | June 12, 2025 | ransomware_live | — |
| Crompton Lamps, UK | June 11, 2025 | ransomware_live | — |
| Mount Rogers Community Services | June 10, 2025 | ransomware_live | — |
| k12albemarle.org | June 10, 2025 | ransomware_live | — |
| Sandhill View County School_UK | June 9, 2025 | ransomware_live | — |
| whiteconlee.com | June 9, 2025 | ransomware_live | — |
| waiwhetu-medical-centre | June 7, 2025 | ransomware_live | — |
| cityofgardendale.com | June 7, 2025 | ransomware_live | — |
| Nunez Dental | June 6, 2025 | ransomware_live | — |
| MTTEXPERTISES.COM | June 6, 2025 | ransomware_live | — |
| scaffoldsolutions.com | June 6, 2025 | ransomware_live | — |
| grupogid.com | June 6, 2025 | ransomware_live | — |
| iscamen | June 5, 2025 | ransomware_live | — |
| https://www.ilesfuneralhomes.com/ | June 5, 2025 | ransomware_live | — |
| heartlineoklahoma.org | June 5, 2025 | ransomware_live | — |
| cemeteries.local | June 4, 2025 | ransomware_live | — |
| communitycareresources.com | June 4, 2025 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).