incransom
Also known as: Inc RansomFirst seen August 9, 2023Active999 claimed victims
The claims below are reproduced as posted by incransom on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europe, having posted over 200 victims in 2025 alone with no sector off-limits.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Töller | July 7, 2025 | ransomware_live | — |
| C B King Memorial School(branch) | July 4, 2025 | ransomware_live | — |
| Majestic | July 4, 2025 | ransomware_live | — |
| MJets | July 4, 2025 | ransomware_live | — |
| Consumer Electronics & Computers Retail Retail | July 2, 2025 | ransomware_live | — |
| coruzcitywndata+ | July 1, 2025 | ransomware_live | — |
| Netstar_South_Africa | July 1, 2025 | ransomware_live | — |
| Сomet-strip-enterprises-ltd | June 30, 2025 | ransomware_live | — |
| erichschleichgmbh.de | June 30, 2025 | ransomware_live | — |
| Wingpoh_SG | June 29, 2025 | ransomware_live | — |
| carolynmyoung.com | June 29, 2025 | ransomware_live | — |
| allmaxnutrition.com | June 27, 2025 | ransomware_live | — |
| The Kingdom of Tonga's Ministry of Health | June 26, 2025 | ransomware_live | — |
| firstpresatl.org | June 26, 2025 | ransomware_live | — |
| Medical Center of Marin | June 25, 2025 | ransomware_live | — |
| deliastamales.com | June 25, 2025 | ransomware_live | — |
| seasonsfour.com | June 24, 2025 | ransomware_live | — |
| AFECC - Hospital Santa Rita de Cássia | June 19, 2025 | ransomware_live | — |
| teampostop.net | June 19, 2025 | ransomware_live | — |
| New Jersey Association on Correction | June 18, 2025 | ransomware_live | — |
| Durant City | June 17, 2025 | ransomware_live | — |
| Lamina Dielectrics, United Kingdom | June 17, 2025 | ransomware_live | — |
| Academic Urology & Urogynecology of Arizona | June 17, 2025 | ransomware_live | — |
| West Texas Oral and Facial Surgery | June 17, 2025 | ransomware_live | — |
| Fund for Reformed Companies (FONPER) | June 17, 2025 | ransomware_live | — |
| erniesinceresco.com | June 17, 2025 | ransomware_live | — |
| doradosoftware.com | June 16, 2025 | ransomware_live | — |
| hitachi-tds.com | June 15, 2025 | ransomware_live | — |
| Sementes Jotabasso | June 15, 2025 | ransomware_live | — |
| lynkspot.com | June 15, 2025 | ransomware_live | — |
| csaas.com | June 12, 2025 | ransomware_live | — |
| neues-leben.de | June 12, 2025 | ransomware_live | — |
| Crompton Lamps, UK | June 11, 2025 | ransomware_live | — |
| Mount Rogers Community Services | June 10, 2025 | ransomware_live | — |
| k12albemarle.org | June 10, 2025 | ransomware_live | — |
| Sandhill View County School_UK | June 9, 2025 | ransomware_live | — |
| whiteconlee.com | June 9, 2025 | ransomware_live | — |
| waiwhetu-medical-centre | June 7, 2025 | ransomware_live | — |
| cityofgardendale.com | June 7, 2025 | ransomware_live | — |
| Nunez Dental | June 6, 2025 | ransomware_live | — |
| MTTEXPERTISES.COM | June 6, 2025 | ransomware_live | — |
| scaffoldsolutions.com | June 6, 2025 | ransomware_live | — |
| grupogid.com | June 6, 2025 | ransomware_live | — |
| iscamen | June 5, 2025 | ransomware_live | — |
| https://www.ilesfuneralhomes.com/ | June 5, 2025 | ransomware_live | — |
| heartlineoklahoma.org | June 5, 2025 | ransomware_live | — |
| cemeteries.local | June 4, 2025 | ransomware_live | — |
| communitycareresources.com | June 4, 2025 | ransomware_live | — |
| Sandhills Medical Foundation | June 3, 2025 | ransomware_live | — |
| Funktel GmbH | June 3, 2025 | ransomware_live | — |
| tiergesundheitszentrum-koenigslutter.de | June 3, 2025 | ransomware_live | — |
| brennytransportation.com | June 3, 2025 | ransomware_live | — |
| jubileejobs.org | June 2, 2025 | ransomware_live | — |
| Universidad Técnica del Norte Ecuador | June 1, 2025 | ransomware_live | — |
| alereon.com | May 31, 2025 | ransomware_live | — |
| alleray-labrouste | May 29, 2025 | ransomware_live | — |
| Rivers Academy West London | May 21, 2025 | ransomware_live | — |
| The Vascular Experts | May 19, 2025 | ransomware_live | — |
| Howard Financial & Associates | May 19, 2025 | ransomware_live | — |
| south african airways (flysaa.com) | May 16, 2025 | ransomware_live | — |
| ccrcda.org | May 16, 2025 | ransomware_live | — |
| ros.eu | May 16, 2025 | ransomware_live | — |
| www.davisdavisco.com | May 16, 2025 | ransomware_live | — |
| finanzconsult-immobilien.de | May 16, 2025 | ransomware_live | — |
| nissi-beach.com | May 16, 2025 | ransomware_live | — |
| Jordan Drug | May 16, 2025 | ransomware_live | — |
| OAK PARK & RIVER FOREST HIGH SCHOOL | May 16, 2025 | ransomware_live | — |
| Morar Construtora e Incorporadora LTDA | May 15, 2025 | ransomware_live | — |
| wvpca.org | May 15, 2025 | ransomware_live | — |
| www.marvimundo.com | May 8, 2025 | ransomware_live | — |
| valuestoreit | May 7, 2025 | ransomware_live | — |
| StudioVaiani | May 1, 2025 | ransomware_live | — |
| The Saint James Hospital Group | April 30, 2025 | ransomware_live | — |
| GARDNER ORTHOPEDICS | April 30, 2025 | ransomware_live | — |
| Hpital Glengarry Memorial Hospital (clglen.local) | April 28, 2025 | ransomware_live | — |
| Kittery Police Department | April 27, 2025 | ransomware_live | — |
| oxparkrec.org | April 25, 2025 | ransomware_live | — |
| lemi-group | April 23, 2025 | ransomware_live | — |
| franklin nursing home | April 22, 2025 | ransomware_live | — |
| piercecountylibrary.org | April 18, 2025 | ransomware_live | — |
| iblinfo.de | April 16, 2025 | ransomware_live | — |
| Koninklijke Ahold Delhaize N.V. | April 16, 2025 | ransomware_live | — |
| trocaire.edu | April 15, 2025 | ransomware_live | — |
| MENTAL HEALTH | April 14, 2025 | ransomware_live | — |
| Orthopaedic Specialists of Connecticut | April 14, 2025 | ransomware_live | — |
| Imagineering Finishing Technologies | April 11, 2025 | ransomware_live | — |
| Chickenshed | April 11, 2025 | ransomware_live | — |
| inspec-international.com | April 10, 2025 | ransomware_live | — |
| ccso2014.local(sheriffs) | April 9, 2025 | ransomware_live | — |
| Thiekon Constructie | April 8, 2025 | ransomware_live | — |
| Coop57 | April 8, 2025 | ransomware_live | — |
| The Loretto Hospital | April 1, 2025 | ransomware_live | — |
| npfy.org | March 31, 2025 | ransomware_live | — |
| alpha-steuer.de | March 31, 2025 | ransomware_live | — |
| augustssons.se | March 28, 2025 | ransomware_live | — |
| City of Fort St. John (city.cityfsj.local) | March 27, 2025 | ransomware_live | — |
| TriCity Family Services | March 26, 2025 | ransomware_live | — |
| allbiz.com | March 24, 2025 | ransomware_live | — |
| TMT Clam Dredger | March 24, 2025 | ransomware_live | — |
| bellendorf.de | March 21, 2025 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).