incransom
Also known as: Inc RansomFirst seen August 9, 2023Active999 claimed victims
The claims below are reproduced as posted by incransom on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europe, having posted over 200 victims in 2025 alone with no sector off-limits.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| arkansasprimarycare.com | March 21, 2025 | ransomware_live | — |
| airtelligence.com | March 18, 2025 | ransomware_live | — |
| expertdata.com.au | March 18, 2025 | ransomware_live | — |
| gaertnerhof-jeutter.de | March 18, 2025 | ransomware_live | — |
| warmsworth.doncaster.sch.uk | March 18, 2025 | ransomware_live | — |
| abeyor.fr | March 15, 2025 | ransomware_live | — |
| mysfa.org | March 13, 2025 | ransomware_live | — |
| Essex County OB/GYN Associates | March 11, 2025 | ransomware_live | — |
| Greenwood Village South GVS | March 9, 2025 | ransomware_live | — |
| State Bar of Texas (www.texasbar.com) | March 9, 2025 | ransomware_live | — |
| finetech.de | March 9, 2025 | ransomware_live | — |
| Naples Heritage Golf & Country Club | March 6, 2025 | ransomware_live | — |
| chesterfieldtwp.org | March 6, 2025 | ransomware_live | — |
| germancentre.sg | March 1, 2025 | ransomware_live | — |
| importantsteps.com | March 1, 2025 | ransomware_live | — |
| silocaf.com | February 28, 2025 | ransomware_live | — |
| sitro.com.au | February 27, 2025 | ransomware_live | — |
| bahnlog.com | February 26, 2025 | ransomware_live | — |
| JA AKITA KITA LIFE SERVICE, K.K | February 25, 2025 | ransomware_live | — |
| alphaoil.ca | February 22, 2025 | ransomware_live | — |
| ehdd.com | February 20, 2025 | ransomware_live | — |
| Persante Health Care | February 17, 2025 | ransomware_live | — |
| newhollandwood.com | February 17, 2025 | ransomware_live | — |
| Bancroft Wines | February 15, 2025 | ransomware_live | — |
| emperors.edu | February 14, 2025 | ransomware_live | — |
| wog-kaiserbaeder.de | February 13, 2025 | ransomware_live | — |
| yeanshalle.de | February 13, 2025 | ransomware_live | — |
| baldaufarchitekten.de | February 11, 2025 | ransomware_live | — |
| wmk-hvb.de | February 11, 2025 | ransomware_live | — |
| City of McKinney | February 9, 2025 | ransomware_live | — |
| Northeast Delta Human Services Authority | February 9, 2025 | ransomware_live | — |
| williampevear.com | February 8, 2025 | ransomware_live | — |
| BerksBar.org | February 7, 2025 | ransomware_live | — |
| breakawayconcretecutting.com | February 5, 2025 | ransomware_live | — |
| The Children's Center Of Hamden | February 4, 2025 | ransomware_live | — |
| statesideseattle.com | February 3, 2025 | ransomware_live | — |
| teamsters175.org | January 31, 2025 | ransomware_live | — |
| megamtls.com | January 31, 2025 | ransomware_live | — |
| pyasolutions.com | January 30, 2025 | ransomware_live | — |
| Mission Locale Montpellier | January 29, 2025 | ransomware_live | — |
| Menominee Tribal Clinic | January 29, 2025 | ransomware_live | — |
| City Of Beloit | January 29, 2025 | ransomware_live | — |
| Heart to Heart Hospice | January 29, 2025 | ransomware_live | — |
| Turning Leaf (TURNINGLEAF.local) | January 29, 2025 | ransomware_live | — |
| tnlottery.com | January 29, 2025 | ransomware_live | — |
| air europa | January 29, 2025 | ransomware_live | — |
| Boldon James | January 29, 2025 | ransomware_live | — |
| International AIDS Vaccine Initiative (iavi.org) | January 27, 2025 | ransomware_live | — |
| Prinston Pharmaceutical (huahaius.com) | January 27, 2025 | ransomware_live | — |
| lhps.org | January 27, 2025 | ransomware_live | — |
| starkaerospace.com | January 23, 2025 | ransomware_live | — |
| evergreenpnw.com | January 22, 2025 | ransomware_live | — |
| RETAL Baltic Films | January 21, 2025 | ransomware_live | — |
| Regina Coeli Convent | January 17, 2025 | ransomware_live | — |
| Taylor Regional Hospital (thcg.local) | January 17, 2025 | ransomware_live | — |
| peponline.org | January 17, 2025 | ransomware_live | — |
| Kilgore College (kilgore.edu) | January 17, 2025 | ransomware_live | — |
| Washington Gastroenterology (DHSWA.NET) | January 17, 2025 | ransomware_live | — |
| Riverina Medical | January 14, 2025 | ransomware_live | — |
| millerwoodtradepub.com | January 12, 2025 | ransomware_live | — |
| californiaclingpeaches.com | January 10, 2025 | ransomware_live | — |
| depewgillen.com | January 9, 2025 | ransomware_live | — |
| Youth Eastside Services | January 8, 2025 | ransomware_live | — |
| cnnindonesia.com | January 5, 2025 | ransomware_live | — |
| Borough of Moonachie | January 5, 2025 | ransomware_live | — |
| lavi.co.il | December 30, 2024 | ransomware_live | — |
| Inner City Family Health Team (ICFHT.local) | December 23, 2024 | ransomware_live | — |
| falp.org | December 22, 2024 | ransomware_live | — |
| fwmep.edu | December 18, 2024 | ransomware_live | — |
| Onecare | December 15, 2024 | ransomware_live | — |
| broward.edu | December 11, 2024 | ransomware_live | — |
| Haji Husein Alireza | December 10, 2024 | ransomware_live | — |
| McKibbin | December 1, 2024 | ransomware_live | — |
| NHS Alder Hey | November 28, 2024 | ransomware_live | — |
| Primary Health Services Center | November 28, 2024 | ransomware_live | — |
| sublettecountywy.gov | November 27, 2024 | ransomware_live | — |
| Hadwins Volkswagen | November 25, 2024 | ransomware_live | — |
| Sa.SS Datentechnik | November 24, 2024 | ransomware_live | — |
| Pastor Real Estate | November 24, 2024 | ransomware_live | — |
| Nicholsons Solicitors | November 24, 2024 | ransomware_live | — |
| Alna-Bioscience | November 23, 2024 | ransomware_live | — |
| IPE Engwicht | November 23, 2024 | ransomware_live | — |
| Schuck-Gruppe | November 23, 2024 | ransomware_live | — |
| Darlington EMS | November 23, 2024 | ransomware_live | — |
| Service Avicole JGL | November 23, 2024 | ransomware_live | — |
| atfservices.com.au | November 23, 2024 | ransomware_live | — |
| Spectrum | November 22, 2024 | ransomware_live | — |
| Zimmerei Buder | November 21, 2024 | ransomware_live | — |
| United Bakery Equipment | November 21, 2024 | ransomware_live | — |
| Brueck Golosow Kim & Associates | November 21, 2024 | ransomware_live | — |
| Goldsmith & Hull | November 21, 2024 | ransomware_live | — |
| borohradek | November 20, 2024 | ransomware_live | — |
| PHARMATIS-SAS | November 15, 2024 | ransomware_live | — |
| aclaser.com.au | November 14, 2024 | ransomware_live | — |
| visufarma.com | November 14, 2024 | ransomware_live | — |
| PBS AEROSPACE | November 4, 2024 | ransomware_live | — |
| Imperial Valley Respite (ivrespite.com) | November 3, 2024 | ransomware_live | — |
| Biomedical Caledonia Medical Laboratory (calmedlab.local) | November 2, 2024 | ransomware_live | — |
| Arc Community Services Inc | November 1, 2024 | ransomware_live | — |
| vbuzrt.hu | October 17, 2024 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).