Close Menu
  • Home
  • News
  • Security
  • Privacy
  • Cybercrime
    • Threat Groups
    • Ransomware
    • Explainers
    • Stealer Logs
  • AI
  • OSINT
  • Tools
    • Ransomtracker
    • Stealercheck
    • FortiBleed Checker
  • Newsletter
  • About Us
Facebook X (Twitter) Instagram Threads
Ransomnews
  • Home
  • News
  • Security
  • Privacy
  • Cybercrime
    • Threat Groups
    • Ransomware
    • Explainers
    • Stealer Logs
  • AI
  • OSINT
  • Tools
    • Ransomtracker
    • Stealercheck
    • FortiBleed Checker
  • Newsletter
  • About Us
Facebook X (Twitter) LinkedIn
Ransomnews

INC-RANSOM · Threat actor profile

// THREAT ACTOR

INC-RANSOM_

Active

INC Ransom is a ransomware operation active since mid-2023, known for double-extortion attacks across healthcare, government, and education.

For Ransomnews editorial coverage of INC-RANSOM — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.

893 Victims tracked
2 / 10 Active mirrors
2023-08-09 First listing
2026-08-19 Most recent

Victims by year

  • 2026 313
  • 2025 369
  • 2024 165
  • 2023 46

Leak site mirrors

10 mirrors tracked, 2 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.

  • incblog7vmuq7rktic73r4ha4j757m3ptym37tyvifzp2roedyyzzxid.onion INC Ransom snapshot · 2024-07-10 02:01
  • incapt.blog Access Blocked snapshot · 2024-04-03 06:07
  • incapt.su Error Response Page snapshot · 2024-07-22 11:02
  • incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad.onion Disclosures snapshot · 2026-08-19 23:03
  • incpaysp74dphcbjyvg2eepxnl3tkgt5mq5vd4tnjusoissz342bdnad.onion snapshot · 2024-12-10 04:25
  • incpaykabjqc2mtdxq6c23nqh4x6m5dkps5fr6vgdkgzp5njssx6qkid.onion NULL snapshot · 2026-08-19 22:01
  • incbacg6bfwtrlzwdbqc55gsfl763s3twdtwhp27dzuik6s6rwdcityd.onion snapshot · 2026-08-19 23:01
  • incbackend.top snapshot · 2025-01-02 00:03
  • incbackfgm7qa7sioq7r4tdunoaqsvzjg5i7w46bhqlfonwjgiemr7qd.onion snapshot · 2024-12-11 09:59
  • incbackrlasjesgpfu5brktfjknbqoahe2hhmqfhasc5fb56mtukn4yd.onion snapshot · 2024-12-11 09:59

Recent victims

The 50 most recent victims claimed by INC-RANSOM. Total in the index: 893.

Date listed Victim Description
2026-08-19 BANGKOKCABLE
2026-08-19 UNIPLASTICS.COM
2026-08-19 CDGARVINLAW
2026-08-19 EXEL
2026-08-18 SD Associates Sdn Bhd
2026-08-18 Third Coast Bancshares
2026-08-18 Foresee Pharmaceuticals
2026-08-18 SpearFin Ltd
2026-08-18 ssf-int.com ssf-ing.de
2026-08-18 nyklawfirm.com nyk.ae
2026-08-17 Lansing Urgent Care
2026-08-17 Otter Tail County, Minnesota
2026-08-14 cambrialawfirm.com
2026-08-14 https://pacific-construction.com/
2026-08-13 clgroup
2026-08-12 gamaus.com
2026-08-12 stuartandassociates.com
2026-08-12 BEDC.COM.AU
2026-08-12 diabetesandmetabolism.com
2026-08-08 Louisville Bar Association
2026-08-07 ATMS
2026-08-06 vprj.org
2026-08-05 lantisnet.com
2026-08-05 Loyalist College
2026-08-05 TRULITE GLASS & ALUMINUM SOLUTIONS
2026-08-04 clintonhealthaccess.org
2026-08-04 pushidrosal.id
2026-08-04 lccgroup.com
2026-08-04 https://geleximco.vn/
2026-08-02 ecfa.org
2026-08-02 quantinuum.com
2026-07-30 PARTNERED HEALTH GROUP
2026-07-30 sslf.local
2026-07-29 harwal.net
2026-07-28 Della Casa Group AG
2026-07-28 https://eclmn.com/
2026-07-28 minigrip.com.mx
2026-07-28 DUCON
2026-07-28 greenecountyga.gov
2026-07-28 foundationstofreedom.org
2026-07-27 takethehop.com
2026-07-26 healthlawadvocates.org
2026-07-24 autismuslink.ch
2026-07-23 cabincreekhealth.com
2026-07-20 Ali-Monde
2026-07-18 v-silicon.com
2026-07-18 FAST.COM.PH
2026-07-18 D.MAG New Material Technology Co., Ltd. Taiwan Giant
2026-07-18 vedan corp
2026-07-18 pokka.co

// CONFIRMED ATTACKS

INC Ransom confirmed attacks: 207 verified incidents

Ransomnews has verified 207 INC Ransom incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from August 2023 to July 2026. United States accounts for 136 of them (66%), with victims recorded in 34 countries in total. The most affected sector is healthcare, at 72 confirmed victims. A ransom payment was publicly confirmed in 0 cases and publicly refused in 20; the outcome is unrecorded in the remaining 187. Where a figure was disclosed (102 cases), these incidents account for 9,280,578 exposed records.

207Verified incidents
34Countries
2023–2026Active range
0%Paid, where outcome known

Confirmed victims by year

  • 202321
  • 202467
  • 202579
  • 202640

Most affected sectors

  • Healthcare72
  • Government30
  • Education21
  • Manufacturing18
  • Other11
  • Service9
  • Technology9
  • Finance8

Most affected countries

  • United States136
  • Australia9
  • Canada8
  • United Kingdom6
  • Germany6
  • Sweden3
  • Spain3
  • South Africa2

Verified INC Ransom incidents (100 most recent of 207)

DateOrganisationSector LocationRecordsRansom paidSource
July 2026 ⁠V-Silicon Semiconductor (Hefei) Co., Ltd. Manufacturing Hefei, China — Unknown Source
July 2026 Loyalist College Education Belleville, Canada — Unknown Source
July 2026 Greene County Government Georgia, United States — Unknown Source
June 2026 Partnered Health Healthcare Eastwood, Australia — Unknown Source
June 2026 Stiftung Autismuslink Healthcare Bern, Switzerland — Unknown Source
June 2026 GSP Crop Science Ltd Manufacturing Navrangpura, India — Unknown Source
June 2026 City of Acworth Government Georgia, United States — Unknown Source
June 2026 Neuwoges Government Neubrandenburg, Germany — No Source
May 2026 SteelcoBelimed AG Healthcare Zug, Switzerland — Unknown Source
May 2026 Distrigaz Vest S.A. Utilities Oradea, Romania — Unknown Source
May 2026 Egnyte, Inc. Technology California, United States — Unknown Source
May 2026 Central Medical Services of Westrock (CMSW) Healthcare New York, United States — Unknown Source
April 2026 Wright-Ryan Construction, Inc. Construction Maine, United States — Unknown Source
April 2026 BELFOR (Asia) Pte Ltd Service Singapore, Singapore — Unknown Source
April 2026 Dorotea Kommun Government Dorotea, Sweden — Unknown Source
April 2026 Mastercom Australia Utilities Granville, Australia — Unknown Source
April 2026 Bendigo & District Aboriginal Co-operative Healthcare North Bendigo, Australia — Unknown Source
April 2026 Berge-Bau GmbH & Co. KG Construction Erndtebrück, Germany — Unknown Source
March 2026 Campbell University Education North Carolina, United States 500 Unknown Source
March 2026 Community Connections Healthcare District of Columbia, United States 20,879 Unknown Source
March 2026 Fulcrum Real Estate Services Service Washington, United States 1,547 Unknown Source
March 2026 Parker Lipman LLP Legal Colorado, United States 1,120 Unknown Source
March 2026 Pulpdent Corporation Healthcare Massachusetts, United States 9 Unknown Source
March 2026 Namibia Airports Company (NAC) Government Windhoek, Namibia — Unknown Source
March 2026 LHT Holdings Limited Manufacturing Singapore, Singapore — Unknown Source
February 2026 Alta Orthopaedics Medical Group, Inc. Healthcare California, United States — Unknown Source
February 2026 City of Cocoa Government Florida, United States 896 Unknown Source
February 2026 Contractors Supply Inc. Retail Rhode Island, United States 181 Unknown Source
February 2026 Glenmark Pharmaceuticals Healthcare Maharashtra, India — Unknown Source
February 2026 City of Meriden Government Connecticut, United States — Unknown Source
February 2026 Lymphedema Therapy Specialists, Inc. Healthcare Texas, United States 378 Unknown Source
February 2026 JA Akita Kita Life Service Co., Ltd. Other Akita, Japan — Unknown Source
February 2026 Air Côte d'Ivoire Transportation Abidjan, Ivory Coast — Unknown Source
January 2026 The Carlson Law Firm Legal Texas, United States 250 Unknown Source
January 2026 Cape Fear Country Club Other North Carolina, United States — Unknown Source
January 2026 Lohmann GmbH & Co. KG Manufacturing Neuwied, Germany 381 Unknown Source
January 2026 Denmark School District Education Wisconsin, United States — Unknown Source
January 2026 Ju Teng International Holdings Ltd. Manufacturing New Taipei City, Taiwan — Unknown Source
January 2026 Beacon Mutual Insurance Company Finance Rhode Island, United States 162,439 Unknown Source
January 2026 Distinctive Systems Technology York, United Kingdom — Unknown Source
December 2025 Chapter 13 Trustee Office of Rod Danielson Legal California, United States 63,857 Unknown Source
December 2025 OSI Systems, Inc. Manufacturing California, United States 4,910 Unknown Source
December 2025 Elmore Goldsmith Kelley & deHoll, P.A. Legal South Carolina, United States — Unknown Source
December 2025 Harrison Design Associates, Inc. Service Georgia, United States 196 Unknown Source
December 2025 Klingele Paper Nova Campina Ltda. Manufacturing Nova Campina, Brazil — Unknown Source
December 2025 Enea AB Technology Stockholm, Sweden — Unknown Source
December 2025 Beyçelik Gestamp Otomotiv Sanayi A.Ş. Manufacturing Bursa, Turkey — Unknown Source
December 2025 Precipio, Inc. Healthcare Connecticut, United States 501 Unknown Source
November 2025 M&Y Personal Injury Lawyers Legal California, United States — Unknown Source
November 2025 Foxconn Interconnect Technology Technology New Taipei City, Taiwan — Unknown Source
November 2025 Schmidt's Handelsgesellschaft mbH Retail Bürs, Austria — Unknown Source
November 2025 Rainbow Communications Utilities Kansas, United States — Unknown Source
November 2025 Valley View Independent School District Education Texas, United States 3,806 Unknown Source
November 2025 OnSolve (Crisis24) - CodeRED Technology Georgia, United States 2,620 Unknown Source
November 2025 Woom GmbH Manufacturing Vienna, Austria — Unknown Source
October 2025 The Ripley Academy and John Flamsteed Community School Education Ripley, United Kingdom — Unknown Source
October 2025 Kelly Legal Legal Mackay, Australia — Unknown Source
October 2025 Benedict Industries Manufacturing Belrose, Australia — Unknown Source
September 2025 Easterseals Northeast Indiana Healthcare Indiana, United States 6,730 Unknown Source
September 2025 Evolve Mortgage Services, LLC Finance Texas, United States 6,663 Unknown Source
September 2025 Summit Golf Brands Manufacturing New York, United States — Unknown Source
September 2025 Humax Holdings Co., Ltd. Manufacturing Bundang-gu, South Korea — Unknown Source
September 2025 Ministerio de Economía y Finanzas de Panamá Government Panama, Panama — Unknown Source
August 2025 Cardinal Services, Inc. Service Oregon, United States 142,323 Unknown Source
August 2025 TAK Broadband LLC Construction South Dakota, United States 20,648 Unknown Source
August 2025 Quadrangle Imaging Center Healthcare Caguas, Puerto Rico 500 Unknown Source
August 2025 Bartek Ingredients Inc. Food and Beverage Stoney Creek, Canada — Unknown Source
August 2025 Georgetown Brewing Co. Food and Beverage Washington, United States 19,696 Unknown Source
August 2025 OB-GYN Associates Healthcare Nevada, United States 62,238 Unknown Source
August 2025 University of St. Thomas Education Texas, United States — Unknown Source
August 2025 Centre de services scolaire des Appalaches (CSSA) Education Thetford Mines, Canada — Unknown Source
August 2025 AWO Landkreis Karlsruhe Healthcare Bruschal, Germany — No Source
August 2025 Pennsylvania Office of Attorney General Government Pennsylvania, United States — No Source
July 2025 Louis Tieu DDS MD Oral & Maxillofacial Surgery (Tieu Dental Corporation) Healthcare California, United States 8,918 Unknown Source
July 2025 Potts, Steele & White, P.A. Finance North Carolina, United States — Unknown Source
July 2025 Lamberts Business Systems Technology Palmerston North, New Zealand — Unknown Source
July 2025 99 Cents Only Stores Retail California, United States — Unknown Source
July 2025 Town of Devon Government Devon, Canada — Unknown Source
July 2025 La Biennale di Venezia Other Venice, Italy — Unknown Source
July 2025 Municipality of Otjiwarongo Government Otjiwarongo, Namibia — Unknown Source
June 2025 Ernie's in Ceresco Retail Nebraska, United States 898 Unknown Source
June 2025 Netstar Technology Johannesburg, South Africa — No Source
June 2025 NEUES LEBEN e.V. Other Wölmersen, Germany — Unknown Source
June 2025 Albemarle County Government Virginia, United States — No Source
June 2025 City of Thomasville Government North Carolina, United States — No Source
June 2025 Marvimundo Retail Alguazas, Spain — No Source
June 2025 Ministry of Health (National Health Information System) Government Tongatapu, Tonga — No Source
June 2025 City of Durant Government Oklahoma, United States — Unknown Source
May 2025 Sandhills Medical Foundation, Inc. Healthcare South Carolina, United States 169,017 Unknown Source
May 2025 National Boat Owners Association (NBOA) Finance Florida, United States 3,580 Unknown Source
May 2025 Academic Urology & Urogynecology of Arizona Healthcare Arizona, United States 73,281 Unknown Source
May 2025 Value Store It Management, Inc. Service Florida, United States 54 Unknown Source
May 2025 West Texas Oral Facial Surgery Healthcare Texas, United States 11,151 Unknown Source
May 2025 Williamsburg Area Medical Assistance Corporation d/b/a Olde Towne Medical and Dental Center (OTMDC) Healthcare Virginia, United States 2,567 Unknown Source
May 2025 Waiwhetu Medical Centre Healthcare Lower Hutt, New Zealand — Unknown Source
May 2025 The Vascular Experts (Southern Connecticut Vascular Center) Healthcare Connecticut, United States 154,417 Unknown Source
May 2025 South African Airways Government Johannesburg, South Africa — Unknown Source
April 2025 Gardner Orthopedics Healthcare Florida, United States 47,000 Unknown Source
April 2025 Mount Rogers Community Services Healthcare Virginia, United States 38,191 Unknown Source
April 2025 Pierce County Library System Government Washington, United States 340,101 Unknown Source

Ransomnews coverage of INC Ransom

  • INC Ransom: the RaaS that wins by mastering the basics

Claimed vs confirmed. The figures above the fold on this page come from INC Ransom's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design — most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.

← Back to Ransomtracker

Statistics on this page are computed by Ransomnews from a live leak-site monitoring feed. Numbers update every ten minutes. Operator-written victim descriptions are truncated and shown in snippet form only. Source data: RansomLook (CC BY 4.0), aggregated and adapted by Ransomnews.

// The Ransomnews Monthly

What leaked, what held up

One email a month: the datasets we verified, and the ones that fell apart under scrutiny.

Double opt-in. We store your email, signup time, and IP for consent records (GDPR Art. 7). See our privacy policy.

// Free tool

Were you in a leak?

Check whether an email address has surfaced in infostealer logs. No signup, no data stored.

Run StealerCheck

// Live data

Ransomtracker

Victims as they are posted to ransomware leak sites, tracked continuously and checked against the claims.

Open the tracker

9,459 confirmed attacks tracked

Facebook X (Twitter) LinkedIn
© 2026 Ransomnews.com

Type above and press Enter to search. Press Esc to cancel.

Cookies on Ransomnews

We use strictly-necessary cookies to run the site and may use first-party analytics to understand which articles are read. Some pages contain affiliate links — when you click one, the affiliate network sets cookies on the merchant's domain to attribute the referral. See the Cookie Policy and Affiliate Disclosure for detail.

RANSOMNEWS.COM

Tracking the criminal infrastructure of the internet.

Independent coverage of ransomware, breach economics, threat actors, privacy, AI security, and the open-source investigation toolkit.

// Topics

  • News
  • Security
  • Privacy
  • Cybercrime
  • AI
  • OSINT
  • Threat Groups
  • Stealer Logs
  • Ransomtracker
  • Stealercheck
  • FortiBleed Checker

// Site

  • About Us
  • Editorial Team
  • Contact
  • Tip Line
  • Editorial

// Legal

  • Privacy Policy
  • Terms of Service
  • Cookie Policy
  • Funding & Independence
  • RSS Feed
© 2026 Ransomnews.com · Tracking the criminal infrastructure of the internet.