incransom
Also known as: Inc RansomFirst seen August 9, 2023Active951 claimed victims
The claims below are reproduced as posted by incransom on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europe, having posted over 200 victims in 2025 alone with no sector off-limits.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Sandhills Medical Foundation | June 3, 2025 | ransomware_live | — |
| Funktel GmbH | June 3, 2025 | ransomware_live | — |
| tiergesundheitszentrum-koenigslutter.de | June 3, 2025 | ransomware_live | — |
| brennytransportation.com | June 3, 2025 | ransomware_live | — |
| jubileejobs.org | June 2, 2025 | ransomware_live | — |
| Universidad Técnica del Norte Ecuador | June 1, 2025 | ransomware_live | — |
| alereon.com | May 31, 2025 | ransomware_live | — |
| alleray-labrouste | May 29, 2025 | ransomware_live | — |
| Rivers Academy West London | May 21, 2025 | ransomware_live | — |
| The Vascular Experts | May 19, 2025 | ransomware_live | — |
| Howard Financial & Associates | May 19, 2025 | ransomware_live | — |
| south african airways (flysaa.com) | May 16, 2025 | ransomware_live | — |
| ccrcda.org | May 16, 2025 | ransomware_live | — |
| ros.eu | May 16, 2025 | ransomware_live | — |
| www.davisdavisco.com | May 16, 2025 | ransomware_live | — |
| finanzconsult-immobilien.de | May 16, 2025 | ransomware_live | — |
| nissi-beach.com | May 16, 2025 | ransomware_live | — |
| Jordan Drug | May 16, 2025 | ransomware_live | — |
| OAK PARK & RIVER FOREST HIGH SCHOOL | May 16, 2025 | ransomware_live | — |
| Morar Construtora e Incorporadora LTDA | May 15, 2025 | ransomware_live | — |
| wvpca.org | May 15, 2025 | ransomware_live | — |
| www.marvimundo.com | May 8, 2025 | ransomware_live | — |
| valuestoreit | May 7, 2025 | ransomware_live | — |
| StudioVaiani | May 1, 2025 | ransomware_live | — |
| The Saint James Hospital Group | April 30, 2025 | ransomware_live | — |
| GARDNER ORTHOPEDICS | April 30, 2025 | ransomware_live | — |
| Hpital Glengarry Memorial Hospital (clglen.local) | April 28, 2025 | ransomware_live | — |
| Kittery Police Department | April 27, 2025 | ransomware_live | — |
| oxparkrec.org | April 25, 2025 | ransomware_live | — |
| lemi-group | April 23, 2025 | ransomware_live | — |
| franklin nursing home | April 22, 2025 | ransomware_live | — |
| piercecountylibrary.org | April 18, 2025 | ransomware_live | — |
| iblinfo.de | April 16, 2025 | ransomware_live | — |
| Koninklijke Ahold Delhaize N.V. | April 16, 2025 | ransomware_live | — |
| trocaire.edu | April 15, 2025 | ransomware_live | — |
| MENTAL HEALTH | April 14, 2025 | ransomware_live | — |
| Orthopaedic Specialists of Connecticut | April 14, 2025 | ransomware_live | — |
| Imagineering Finishing Technologies | April 11, 2025 | ransomware_live | — |
| Chickenshed | April 11, 2025 | ransomware_live | — |
| inspec-international.com | April 10, 2025 | ransomware_live | — |
| ccso2014.local(sheriffs) | April 9, 2025 | ransomware_live | — |
| Thiekon Constructie | April 8, 2025 | ransomware_live | — |
| Coop57 | April 8, 2025 | ransomware_live | — |
| The Loretto Hospital | April 1, 2025 | ransomware_live | — |
| npfy.org | March 31, 2025 | ransomware_live | — |
| alpha-steuer.de | March 31, 2025 | ransomware_live | — |
| augustssons.se | March 28, 2025 | ransomware_live | — |
| City of Fort St. John (city.cityfsj.local) | March 27, 2025 | ransomware_live | — |
| TriCity Family Services | March 26, 2025 | ransomware_live | — |
| allbiz.com | March 24, 2025 | ransomware_live | — |
| TMT Clam Dredger | March 24, 2025 | ransomware_live | — |
| bellendorf.de | March 21, 2025 | ransomware_live | — |
| arkansasprimarycare.com | March 21, 2025 | ransomware_live | — |
| airtelligence.com | March 18, 2025 | ransomware_live | — |
| expertdata.com.au | March 18, 2025 | ransomware_live | — |
| gaertnerhof-jeutter.de | March 18, 2025 | ransomware_live | — |
| warmsworth.doncaster.sch.uk | March 18, 2025 | ransomware_live | — |
| abeyor.fr | March 15, 2025 | ransomware_live | — |
| mysfa.org | March 13, 2025 | ransomware_live | — |
| Essex County OB/GYN Associates | March 11, 2025 | ransomware_live | — |
| Greenwood Village South GVS | March 9, 2025 | ransomware_live | — |
| State Bar of Texas (www.texasbar.com) | March 9, 2025 | ransomware_live | — |
| finetech.de | March 9, 2025 | ransomware_live | — |
| Naples Heritage Golf & Country Club | March 6, 2025 | ransomware_live | — |
| chesterfieldtwp.org | March 6, 2025 | ransomware_live | — |
| germancentre.sg | March 1, 2025 | ransomware_live | — |
| importantsteps.com | March 1, 2025 | ransomware_live | — |
| silocaf.com | February 28, 2025 | ransomware_live | — |
| sitro.com.au | February 27, 2025 | ransomware_live | — |
| bahnlog.com | February 26, 2025 | ransomware_live | — |
| JA AKITA KITA LIFE SERVICE, K.K | February 25, 2025 | ransomware_live | — |
| alphaoil.ca | February 22, 2025 | ransomware_live | — |
| ehdd.com | February 20, 2025 | ransomware_live | — |
| Persante Health Care | February 17, 2025 | ransomware_live | — |
| newhollandwood.com | February 17, 2025 | ransomware_live | — |
| Bancroft Wines | February 15, 2025 | ransomware_live | — |
| emperors.edu | February 14, 2025 | ransomware_live | — |
| wog-kaiserbaeder.de | February 13, 2025 | ransomware_live | — |
| yeanshalle.de | February 13, 2025 | ransomware_live | — |
| baldaufarchitekten.de | February 11, 2025 | ransomware_live | — |
| wmk-hvb.de | February 11, 2025 | ransomware_live | — |
| City of McKinney | February 9, 2025 | ransomware_live | — |
| Northeast Delta Human Services Authority | February 9, 2025 | ransomware_live | — |
| williampevear.com | February 8, 2025 | ransomware_live | — |
| BerksBar.org | February 7, 2025 | ransomware_live | — |
| breakawayconcretecutting.com | February 5, 2025 | ransomware_live | — |
| The Children's Center Of Hamden | February 4, 2025 | ransomware_live | — |
| statesideseattle.com | February 3, 2025 | ransomware_live | — |
| teamsters175.org | January 31, 2025 | ransomware_live | — |
| megamtls.com | January 31, 2025 | ransomware_live | — |
| pyasolutions.com | January 30, 2025 | ransomware_live | — |
| Mission Locale Montpellier | January 29, 2025 | ransomware_live | — |
| Menominee Tribal Clinic | January 29, 2025 | ransomware_live | — |
| City Of Beloit | January 29, 2025 | ransomware_live | — |
| Heart to Heart Hospice | January 29, 2025 | ransomware_live | — |
| Turning Leaf (TURNINGLEAF.local) | January 29, 2025 | ransomware_live | — |
| tnlottery.com | January 29, 2025 | ransomware_live | — |
| air europa | January 29, 2025 | ransomware_live | — |
| Boldon James | January 29, 2025 | ransomware_live | — |
| International AIDS Vaccine Initiative (iavi.org) | January 27, 2025 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).