incransom
Also known as: Inc RansomFirst seen August 9, 2023Active951 claimed victims
The claims below are reproduced as posted by incransom on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europe, having posted over 200 victims in 2025 alone with no sector off-limits.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Prinston Pharmaceutical (huahaius.com) | January 27, 2025 | ransomware_live | — |
| lhps.org | January 27, 2025 | ransomware_live | — |
| starkaerospace.com | January 23, 2025 | ransomware_live | — |
| evergreenpnw.com | January 22, 2025 | ransomware_live | — |
| RETAL Baltic Films | January 21, 2025 | ransomware_live | — |
| Regina Coeli Convent | January 17, 2025 | ransomware_live | — |
| Taylor Regional Hospital (thcg.local) | January 17, 2025 | ransomware_live | — |
| peponline.org | January 17, 2025 | ransomware_live | — |
| Kilgore College (kilgore.edu) | January 17, 2025 | ransomware_live | — |
| Washington Gastroenterology (DHSWA.NET) | January 17, 2025 | ransomware_live | — |
| Riverina Medical | January 14, 2025 | ransomware_live | — |
| millerwoodtradepub.com | January 12, 2025 | ransomware_live | — |
| californiaclingpeaches.com | January 10, 2025 | ransomware_live | — |
| depewgillen.com | January 9, 2025 | ransomware_live | — |
| Youth Eastside Services | January 8, 2025 | ransomware_live | — |
| cnnindonesia.com | January 5, 2025 | ransomware_live | — |
| Borough of Moonachie | January 5, 2025 | ransomware_live | — |
| lavi.co.il | December 30, 2024 | ransomware_live | — |
| Inner City Family Health Team (ICFHT.local) | December 23, 2024 | ransomware_live | — |
| falp.org | December 22, 2024 | ransomware_live | — |
| fwmep.edu | December 18, 2024 | ransomware_live | — |
| Onecare | December 15, 2024 | ransomware_live | — |
| broward.edu | December 11, 2024 | ransomware_live | — |
| Haji Husein Alireza | December 10, 2024 | ransomware_live | — |
| McKibbin | December 1, 2024 | ransomware_live | — |
| NHS Alder Hey | November 28, 2024 | ransomware_live | — |
| Primary Health Services Center | November 28, 2024 | ransomware_live | — |
| sublettecountywy.gov | November 27, 2024 | ransomware_live | — |
| Hadwins Volkswagen | November 25, 2024 | ransomware_live | — |
| Sa.SS Datentechnik | November 24, 2024 | ransomware_live | — |
| Pastor Real Estate | November 24, 2024 | ransomware_live | — |
| Nicholsons Solicitors | November 24, 2024 | ransomware_live | — |
| Alna-Bioscience | November 23, 2024 | ransomware_live | — |
| IPE Engwicht | November 23, 2024 | ransomware_live | — |
| Schuck-Gruppe | November 23, 2024 | ransomware_live | — |
| Darlington EMS | November 23, 2024 | ransomware_live | — |
| Service Avicole JGL | November 23, 2024 | ransomware_live | — |
| atfservices.com.au | November 23, 2024 | ransomware_live | — |
| Spectrum | November 22, 2024 | ransomware_live | — |
| Zimmerei Buder | November 21, 2024 | ransomware_live | — |
| United Bakery Equipment | November 21, 2024 | ransomware_live | — |
| Brueck Golosow Kim & Associates | November 21, 2024 | ransomware_live | — |
| Goldsmith & Hull | November 21, 2024 | ransomware_live | — |
| borohradek | November 20, 2024 | ransomware_live | — |
| PHARMATIS-SAS | November 15, 2024 | ransomware_live | — |
| aclaser.com.au | November 14, 2024 | ransomware_live | — |
| visufarma.com | November 14, 2024 | ransomware_live | — |
| PBS AEROSPACE | November 4, 2024 | ransomware_live | — |
| Imperial Valley Respite (ivrespite.com) | November 3, 2024 | ransomware_live | — |
| Biomedical Caledonia Medical Laboratory (calmedlab.local) | November 2, 2024 | ransomware_live | — |
| Arc Community Services Inc | November 1, 2024 | ransomware_live | — |
| vbuzrt.hu | October 17, 2024 | ransomware_live | — |
| formpipe.com | October 13, 2024 | ransomware_live | — |
| San Francisco Ballet | October 12, 2024 | ransomware_live | — |
| Black Creek Community Health Centre (bcch.local) | October 12, 2024 | ransomware_live | — |
| Doctors Regional Cancer Center | October 10, 2024 | ransomware_live | — |
| Storck-Baugesellschaft mbH | October 4, 2024 | ransomware_live | — |
| Quantum Healthcare | October 1, 2024 | ransomware_live | — |
| DINAS Corp | September 29, 2024 | ransomware_live | — |
| Divine Interprises INC | September 29, 2024 | ransomware_live | — |
| Direct Access Partners | September 28, 2024 | ransomware_live | — |
| ucv.es | September 28, 2024 | ransomware_live | — |
| europe-qualité | September 24, 2024 | ransomware_live | — |
| Visionary Homes | September 20, 2024 | ransomware_live | — |
| Webb Institute | September 20, 2024 | ransomware_live | — |
| Nusser Mineralöl GmbH | September 19, 2024 | ransomware_live | — |
| OnePoint Patient Care | September 12, 2024 | ransomware_live | — |
| E-Z Pack Holdings LLC | September 10, 2024 | ransomware_live | — |
| Regent Care Center | September 10, 2024 | ransomware_live | — |
| ERoko Distributors + Colonial Countertops | August 24, 2024 | ransomware_live | — |
| Don’t Waste Group | August 22, 2024 | ransomware_live | — |
| HL Lawson & Sons | August 22, 2024 | ransomware_live | — |
| Cathedral Prep (villalan.edu) | August 18, 2024 | ransomware_live | — |
| The University and College Union | August 9, 2024 | ransomware_live | — |
| San Francisco Sheriff's Department (sjcso.local) | August 9, 2024 | ransomware_live | — |
| Health Quality Council | August 7, 2024 | ransomware_live | — |
| Larc | July 24, 2024 | ransomware_live | — |
| Association Management Strategies(AAMC.local) | July 23, 2024 | ransomware_live | — |
| Norther n Bedford County School District (nbcsc.org) | July 17, 2024 | ransomware_live | — |
| maingroup | July 16, 2024 | ransomware_live | — |
| CIMP.COM | July 8, 2024 | ransomware_live | — |
| A.L.P. Lighting Components | July 6, 2024 | ransomware_live | — |
| waupaca.wi.us | July 5, 2024 | ransomware_live | — |
| waupacacounty-wi.gov | July 5, 2024 | ransomware_live | — |
| Center for Human Capital Innovation (centerforhci.org) | July 5, 2024 | ransomware_live | — |
| REPLIGEN | July 3, 2024 | ransomware_live | — |
| HP Distribution | July 2, 2024 | ransomware_live | — |
| State of Alabama - Alabama Department Of Education | July 1, 2024 | ransomware_live | — |
| Boombah Inc. | June 29, 2024 | ransomware_live | — |
| erne | June 27, 2024 | ransomware_live | — |
| Cambridge University Press & Assessment | June 24, 2024 | ransomware_live | — |
| Guhring USA | June 24, 2024 | ransomware_live | — |
| City Of Coon Rapids | June 23, 2024 | ransomware_live | — |
| Puyallup Tribe (ptoi.local) | June 23, 2024 | ransomware_live | — |
| Behavioral Health Response (bhr.local) | June 19, 2024 | ransomware_live | — |
| middletown-township.org | June 18, 2024 | ransomware_live | — |
| Sensory Spectrum | June 17, 2024 | ransomware_live | — |
| Kito Canada | June 13, 2024 | ransomware_live | — |
| Gorrie-Regan | June 13, 2024 | ransomware_live | — |
| Sacred Heart Community Service (shcstheheart.org) | June 13, 2024 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).