incransom
Also known as: Inc RansomFirst seen August 9, 2023Active951 claimed victims
The claims below are reproduced as posted by incransom on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europe, having posted over 200 victims in 2025 alone with no sector off-limits.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Maryhaven (MHCLINICAL.LOCAL) | June 13, 2024 | ransomware_live | — |
| GBA GROUP | June 13, 2024 | ransomware_live | — |
| DERBY SCHOOL | June 11, 2024 | ransomware_live | — |
| OCEANAIR | June 10, 2024 | ransomware_live | — |
| Planar | June 8, 2024 | ransomware_live | — |
| The Coffee Bean & Tea Leaf | June 6, 2024 | ransomware_live | — |
| aloft | May 31, 2024 | ransomware_live | — |
| Rockford Public School District | May 30, 2024 | ransomware_live | — |
| CONTROLNET | May 29, 2024 | ransomware_live | — |
| a4hs-dom.local | May 27, 2024 | ransomware_live | — |
| Hands TheFamilyHelpNetwork.ca | May 23, 2024 | ransomware_live | — |
| First Nations Health Authority (fnha.local) | May 22, 2024 | ransomware_live | — |
| Midwest Covenant Home | May 22, 2024 | ransomware_live | — |
| Richland City Hall | May 22, 2024 | ransomware_live | — |
| Continuing Healthcare Solutions (chs.local) | May 20, 2024 | ransomware_live | — |
| Sterling Transportation Services (sts.local) | May 20, 2024 | ransomware_live | — |
| Specialty Market Managers | May 20, 2024 | ransomware_live | — |
| California Highway Patrol (SVEL237.org) | May 20, 2024 | ransomware_live | — |
| Crandall ISD (CISD.crandallisd.org) | May 20, 2024 | ransomware_live | — |
| drmsusa.com | May 18, 2024 | ransomware_live | — |
| Regional Obstetrical Consultants | May 18, 2024 | ransomware_live | — |
| Talley Group | May 14, 2024 | ransomware_live | — |
| Eden Project | May 13, 2024 | ransomware_live | — |
| Helapet Ltd | May 13, 2024 | ransomware_live | — |
| Eden Project Ltd | May 13, 2024 | ransomware_live | — |
| NHS (press update) | May 11, 2024 | ransomware_live | — |
| Electric Mirror Inc | May 8, 2024 | ransomware_live | — |
| gravetye-manor | May 8, 2024 | ransomware_live | — |
| aharvey.nf.ca | May 8, 2024 | ransomware_live | — |
| Access Sports Medicine & Orthopaedics | May 8, 2024 | ransomware_live | — |
| allied-mechanical-services-inc | May 7, 2024 | ransomware_live | — |
| Electric Mirror | May 6, 2024 | ransomware_live | — |
| Deeside Timberframe | May 6, 2024 | ransomware_live | — |
| Seneca Nation Health System | May 5, 2024 | ransomware_live | — |
| Seaman's Mechanical | May 3, 2024 | ransomware_live | — |
| trugreen.com | May 3, 2024 | ransomware_live | — |
| Pinnacle Orthopaedics | May 2, 2024 | ransomware_live | — |
| City of Buckeye (buckeyeaz.gov) | May 1, 2024 | ransomware_live | — |
| Sobieski Services Inc | April 30, 2024 | ransomware_live | — |
| Trylon Srl | April 30, 2024 | ransomware_live | — |
| It4 Solutions Robras Corp | April 30, 2024 | ransomware_live | — |
| NELLESFRERES | April 30, 2024 | ransomware_live | — |
| JFK Financial Inc. | April 30, 2024 | ransomware_live | — |
| Mainline Health Systems (MHS.local) | April 29, 2024 | ransomware_live | — |
| DBK Partners | April 29, 2024 | ransomware_live | — |
| Human Technology Inc. | April 27, 2024 | ransomware_live | — |
| Fribin | April 25, 2024 | ransomware_live | — |
| Softura | April 23, 2024 | ransomware_live | — |
| Audubon Nature Institute (auduboninstitute.org) | April 23, 2024 | ransomware_live | — |
| Hanzestrohm | April 23, 2024 | ransomware_live | — |
| SISU Healthcare Solutions | April 23, 2024 | ransomware_live | — |
| Direct Mail | April 22, 2024 | ransomware_live | — |
| Cleveland City School District | April 22, 2024 | ransomware_live | — |
| Village Building | April 22, 2024 | ransomware_live | — |
| UNITE HERE! | April 22, 2024 | ransomware_live | — |
| Conception Reproductive Associates Colorado | April 22, 2024 | ransomware_live | — |
| Lutheran Social Services of Indiana | April 20, 2024 | ransomware_live | — |
| Continuing Healthcare Solutions | April 20, 2024 | ransomware_live | — |
| Delano Joint Union High School District | April 17, 2024 | ransomware_live | — |
| US-Saudi Arabian Business Council | April 17, 2024 | ransomware_live | — |
| Delano Adult School (DJUHSD.ORG) | April 17, 2024 | ransomware_live | — |
| William S. Hein & Co. | April 17, 2024 | ransomware_live | — |
| Vicon | April 16, 2024 | ransomware_live | — |
| BPG Building Partners Group | April 16, 2024 | ransomware_live | — |
| Black Butte Coal | April 16, 2024 | ransomware_live | — |
| WellLife Network | April 16, 2024 | ransomware_live | — |
| Pulaski academy | April 15, 2024 | ransomware_live | — |
| Druckman Law Group | April 15, 2024 | ransomware_live | — |
| Yamaha Motor Philippines | April 13, 2024 | ransomware_live | — |
| Henningson & Snoxell, Ltd. | April 11, 2024 | ransomware_live | — |
| Community Alliance | April 11, 2024 | ransomware_live | — |
| Xerox | April 10, 2024 | ransomware_live | — |
| Remitano - Cryptocurrency Exchange | April 4, 2024 | ransomware_live | — |
| Leicester City Council | April 3, 2024 | ransomware_live | — |
| Norman Urology Associates | April 3, 2024 | ransomware_live | — |
| West Idaho Orthopedics | April 3, 2024 | ransomware_live | — |
| Sisu Healthcare | April 1, 2024 | ransomware_live | — |
| Blueline Associates | April 1, 2024 | ransomware_live | — |
| Xenwerx Initiatives, LLC | April 1, 2024 | ransomware_live | — |
| Tech-Quip Inc | March 29, 2024 | ransomware_live | — |
| PSEC Church | March 29, 2024 | ransomware_live | — |
| Lodan Electronics Inc | March 29, 2024 | ransomware_live | — |
| Graypen Ltd | March 29, 2024 | ransomware_live | — |
| Florida Memorial University | March 28, 2024 | ransomware_live | — |
| Otolaryngology Associates, LLC | March 27, 2024 | ransomware_live | — |
| Barrie and Community Family Health Team | March 26, 2024 | ransomware_live | — |
| NHS Scotland | March 26, 2024 | ransomware_live | — |
| Pantana CPA | March 25, 2024 | ransomware_live | — |
| Law Offices of John V. Orrick, P.L. | March 25, 2024 | ransomware_live | — |
| Ejército del Per | March 25, 2024 | ransomware_live | — |
| Acculabs Inc | March 16, 2024 | ransomware_live | — |
| Liquid Environmental Solutions | March 6, 2024 | ransomware_live | — |
| Orange Public School District | February 28, 2024 | ransomware_live | — |
| WEL Partners | February 27, 2024 | ransomware_live | — |
| Hardeman County Community Health Center | February 27, 2024 | ransomware_live | — |
| Pacific American Fish Company Inc. | February 10, 2024 | ransomware_live | — |
| North American University | January 29, 2024 | ransomware_live | — |
| CORBETT EXTERMINATING Inc | January 29, 2024 | ransomware_live | — |
| Benjamin Plumbing Inc | January 29, 2024 | ransomware_live | — |
| Waterford Country School Inc | January 29, 2024 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).