incransom
Also known as: Inc RansomFirst seen August 9, 2023Active999 claimed victims
The claims below are reproduced as posted by incransom on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europe, having posted over 200 victims in 2025 alone with no sector off-limits.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| formpipe.com | October 13, 2024 | ransomware_live | — |
| San Francisco Ballet | October 12, 2024 | ransomware_live | — |
| Black Creek Community Health Centre (bcch.local) | October 12, 2024 | ransomware_live | — |
| Doctors Regional Cancer Center | October 10, 2024 | ransomware_live | — |
| Storck-Baugesellschaft mbH | October 4, 2024 | ransomware_live | — |
| Quantum Healthcare | October 1, 2024 | ransomware_live | — |
| DINAS Corp | September 29, 2024 | ransomware_live | — |
| Divine Interprises INC | September 29, 2024 | ransomware_live | — |
| Direct Access Partners | September 28, 2024 | ransomware_live | — |
| ucv.es | September 28, 2024 | ransomware_live | — |
| europe-qualité | September 24, 2024 | ransomware_live | — |
| Visionary Homes | September 20, 2024 | ransomware_live | — |
| Webb Institute | September 20, 2024 | ransomware_live | — |
| Nusser Mineralöl GmbH | September 19, 2024 | ransomware_live | — |
| OnePoint Patient Care | September 12, 2024 | ransomware_live | — |
| E-Z Pack Holdings LLC | September 10, 2024 | ransomware_live | — |
| Regent Care Center | September 10, 2024 | ransomware_live | — |
| ERoko Distributors + Colonial Countertops | August 24, 2024 | ransomware_live | — |
| Don’t Waste Group | August 22, 2024 | ransomware_live | — |
| HL Lawson & Sons | August 22, 2024 | ransomware_live | — |
| Cathedral Prep (villalan.edu) | August 18, 2024 | ransomware_live | — |
| The University and College Union | August 9, 2024 | ransomware_live | — |
| San Francisco Sheriff's Department (sjcso.local) | August 9, 2024 | ransomware_live | — |
| Health Quality Council | August 7, 2024 | ransomware_live | — |
| Larc | July 24, 2024 | ransomware_live | — |
| Association Management Strategies(AAMC.local) | July 23, 2024 | ransomware_live | — |
| Norther n Bedford County School District (nbcsc.org) | July 17, 2024 | ransomware_live | — |
| maingroup | July 16, 2024 | ransomware_live | — |
| CIMP.COM | July 8, 2024 | ransomware_live | — |
| A.L.P. Lighting Components | July 6, 2024 | ransomware_live | — |
| waupaca.wi.us | July 5, 2024 | ransomware_live | — |
| waupacacounty-wi.gov | July 5, 2024 | ransomware_live | — |
| Center for Human Capital Innovation (centerforhci.org) | July 5, 2024 | ransomware_live | — |
| REPLIGEN | July 3, 2024 | ransomware_live | — |
| HP Distribution | July 2, 2024 | ransomware_live | — |
| State of Alabama - Alabama Department Of Education | July 1, 2024 | ransomware_live | — |
| Boombah Inc. | June 29, 2024 | ransomware_live | — |
| erne | June 27, 2024 | ransomware_live | — |
| Cambridge University Press & Assessment | June 24, 2024 | ransomware_live | — |
| Guhring USA | June 24, 2024 | ransomware_live | — |
| City Of Coon Rapids | June 23, 2024 | ransomware_live | — |
| Puyallup Tribe (ptoi.local) | June 23, 2024 | ransomware_live | — |
| Behavioral Health Response (bhr.local) | June 19, 2024 | ransomware_live | — |
| middletown-township.org | June 18, 2024 | ransomware_live | — |
| Sensory Spectrum | June 17, 2024 | ransomware_live | — |
| Kito Canada | June 13, 2024 | ransomware_live | — |
| Gorrie-Regan | June 13, 2024 | ransomware_live | — |
| Sacred Heart Community Service (shcstheheart.org) | June 13, 2024 | ransomware_live | — |
| Maryhaven (MHCLINICAL.LOCAL) | June 13, 2024 | ransomware_live | — |
| GBA GROUP | June 13, 2024 | ransomware_live | — |
| DERBY SCHOOL | June 11, 2024 | ransomware_live | — |
| OCEANAIR | June 10, 2024 | ransomware_live | — |
| Planar | June 8, 2024 | ransomware_live | — |
| The Coffee Bean & Tea Leaf | June 6, 2024 | ransomware_live | — |
| aloft | May 31, 2024 | ransomware_live | — |
| Rockford Public School District | May 30, 2024 | ransomware_live | — |
| CONTROLNET | May 29, 2024 | ransomware_live | — |
| a4hs-dom.local | May 27, 2024 | ransomware_live | — |
| Hands TheFamilyHelpNetwork.ca | May 23, 2024 | ransomware_live | — |
| First Nations Health Authority (fnha.local) | May 22, 2024 | ransomware_live | — |
| Midwest Covenant Home | May 22, 2024 | ransomware_live | — |
| Richland City Hall | May 22, 2024 | ransomware_live | — |
| Continuing Healthcare Solutions (chs.local) | May 20, 2024 | ransomware_live | — |
| Sterling Transportation Services (sts.local) | May 20, 2024 | ransomware_live | — |
| Specialty Market Managers | May 20, 2024 | ransomware_live | — |
| California Highway Patrol (SVEL237.org) | May 20, 2024 | ransomware_live | — |
| Crandall ISD (CISD.crandallisd.org) | May 20, 2024 | ransomware_live | — |
| drmsusa.com | May 18, 2024 | ransomware_live | — |
| Regional Obstetrical Consultants | May 18, 2024 | ransomware_live | — |
| Talley Group | May 14, 2024 | ransomware_live | — |
| Eden Project | May 13, 2024 | ransomware_live | — |
| Helapet Ltd | May 13, 2024 | ransomware_live | — |
| Eden Project Ltd | May 13, 2024 | ransomware_live | — |
| NHS (press update) | May 11, 2024 | ransomware_live | — |
| Electric Mirror Inc | May 8, 2024 | ransomware_live | — |
| gravetye-manor | May 8, 2024 | ransomware_live | — |
| aharvey.nf.ca | May 8, 2024 | ransomware_live | — |
| Access Sports Medicine & Orthopaedics | May 8, 2024 | ransomware_live | — |
| allied-mechanical-services-inc | May 7, 2024 | ransomware_live | — |
| Electric Mirror | May 6, 2024 | ransomware_live | — |
| Deeside Timberframe | May 6, 2024 | ransomware_live | — |
| Seneca Nation Health System | May 5, 2024 | ransomware_live | — |
| Seaman's Mechanical | May 3, 2024 | ransomware_live | — |
| trugreen.com | May 3, 2024 | ransomware_live | — |
| Pinnacle Orthopaedics | May 2, 2024 | ransomware_live | — |
| City of Buckeye (buckeyeaz.gov) | May 1, 2024 | ransomware_live | — |
| Sobieski Services Inc | April 30, 2024 | ransomware_live | — |
| Trylon Srl | April 30, 2024 | ransomware_live | — |
| It4 Solutions Robras Corp | April 30, 2024 | ransomware_live | — |
| NELLESFRERES | April 30, 2024 | ransomware_live | — |
| JFK Financial Inc. | April 30, 2024 | ransomware_live | — |
| Mainline Health Systems (MHS.local) | April 29, 2024 | ransomware_live | — |
| DBK Partners | April 29, 2024 | ransomware_live | — |
| Human Technology Inc. | April 27, 2024 | ransomware_live | — |
| Fribin | April 25, 2024 | ransomware_live | — |
| Softura | April 23, 2024 | ransomware_live | — |
| Audubon Nature Institute (auduboninstitute.org) | April 23, 2024 | ransomware_live | — |
| Hanzestrohm | April 23, 2024 | ransomware_live | — |
| SISU Healthcare Solutions | April 23, 2024 | ransomware_live | — |
| Direct Mail | April 22, 2024 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).