inc ransom
ransomware group · aka INC, INC Ransom, INC Ransomware · unknown · active since 2023-07
- Victims · 7d0−3 vs prior week
- Victims · 30d21
- Victims · 90d102
- All-time (tracked)966since 2023-08-09
- Last post10-22 01:31UTC
- Estimated earnings—public reporting
Profile · grok-4.7 · updated Summaries by Vani AI
INC Ransom is a financially motivated ransomware and data-extortion group first publicly reported in July 2023. It uses double extortion: data is stolen and systems are encrypted, with publication threatened on a dedicated leak site if a ransom is not paid. Vendor research has described code and tradecraft overlap with the later Lynx ransomware brand, but a complete rebrand is not established and INC-branded listings have continued. Dashboard leak-site tracking shows 118 listings since 2026-07-14 (39 in 30 days, 9 in 7 days), with the last post on 2026-10-08. Geographic attribution and total ransom revenue are unknown.
Tactics & tooling
- Double extortion: encryption combined with data theft and leak-site publication threats
- Initial access reported via compromised remote-access credentials (VPN/RDP) and phishing
- Intrusions aimed at organizations rather than only mass opportunistic encryption
- Data staged and exfiltrated before encryption
- Custom Windows encryptor and ransom note directing victims to a negotiation channel
- Pressure via leak-site countdown timers and limited public data samples
- Claimed victims span schools, healthcare, local government, manufacturing, and utilities
Targeted sectors
educationhealthcarelocal governmentmanufacturingutilitiesprofessional services
Notable public victims
The New Community School, UAE Pro League, City of Cloverdale, Sangre de Cristo Electric Association, Guardian Pharmacy LLC, Den Hartog Industries, Wavecrest HFA
Estimated earnings
No public figure.
Leak-site victims
966 posts · newest first| Victim | Discovered | Details |
|---|---|---|
| bereskinparr.com smartbiggar.ca | · 10d ago | — |
| centralrogers.com | · 11d ago | — |
| Seetelhotels.de | · 12d ago | — |
| www.coopecaja.fi.cr | · 16d ago | — |
| nowaszkola.com | · 16d ago | — |
| fairfeelegalservices.com | · 16d ago | — |
| verveba.com \ www.att.com | · 16d ago | — |
| FINANCIAMENTO LTDA | · 18d ago | — |
| Wolf & Sofsky GmbH | · 19d ago | — |
| Great Lakes | · 19d ago | — |
| brookslawfirm.com | · 20d ago | — |
| hsc.mb.ca | · 21d ago | — |
| The New Community School | · 24d ago | — |
| Wavecrest HFA | · 25d ago | — |
| Tec Imports | · 25d ago | — |
| UAE Pro League | · 25d ago | — |
| City of Cloverdale | · 25d ago | — |
| acmestamping.com | · 25d ago | — |
| harborpacific.com | · 25d ago | — |
| architekt-vondanwitz.de | · 25d ago | — |
| magnals.com | · 26d ago | — |
| Sangre de Cristo Electric Association | · Oct 2, 2026 | — |
| Guardian Pharmacy LLC | · Oct 1, 2026 | — |
| Den Hartog Industries | · Oct 1, 2026 | — |
| Northern Counties Health Care | · Oct 1, 2026 | — |
| Post Metal Recycling | · Oct 1, 2026 | — |
| Rimrock Foundation | · Oct 1, 2026 | — |
| bcx.co.za | · Sep 29, 2026 | — |
| bakemyday.se | · Sep 28, 2026 | — |
| AHEAD | · Sep 28, 2026 | — |
| nsbsd.org | · Sep 28, 2026 | — |
| pharma5.ma | · Sep 25, 2026 | — |
| welgenone.com | · Sep 24, 2026 | — |
| ukbjja.org | · Sep 24, 2026 | — |
| bnlawmacau.com www.bn-ip.com | · Sep 24, 2026 | — |
| Grupo Caberj | · Sep 24, 2026 | — |
| Lemon Law | · Sep 23, 2026 | — |
| SECOND HOUSE | · Sep 21, 2026 | — |
| Maryann Kriger | · Sep 21, 2026 | — |
| www.roancampingholidays.com | · Sep 18, 2026 | — |
| www.kendallhunt.com | · Sep 18, 2026 | — |
| www.appliancefactory.com | · Sep 17, 2026 | — |
| www.diarco.com.ar | · Sep 17, 2026 | — |
| Silicon Integrated Systems | · Sep 17, 2026 | — |
| Partners Financial Services, a.s. | · Sep 16, 2026 | Date: September 2026 Target: Partners Financial Services, a.s. (IČO: 27699781) Location: Prague, Czech Republic Industry: Financial Services / Banking / Insurance |
| aidon.com | · Sep 16, 2026 | Aidon Oy / Gridspertise (Enel Group) — Smart Meter Operations Platform Breach Date: September 2026 Sector: Critical Infrastructure — Energy / Smart Grid Country: Finland Parent Company: Gridspertise S.r.l. (joint venture: Enel Group + CVC Capital Partners) |
| Zito Marketi | · Sep 16, 2026 | In the retail industry, there is a persistent myth that to scale nationally, a brand must inevitably shed its local soul. The prevailing logic dictates that as a chain expands, the neighborhood warmth of its origins is replaced by sterile corporate efficiency, and the familiar faces behind the counter are swapped for standardized kiosks. But in North Macedonia, a retail network that now spans dozens of towns and employs over 850 people is quietly dismantling that assumption. They are proving that the secret to dominating a national market might just be remembering exactly what it feels like to run a single corner store. |
| City of Princeton | · Sep 16, 2026 | Date added: September 2026 Website: princetontx.us Sector: Government / Municipal Administration Location: Collin County, Texas, USA (Dallas-Fort Worth Metroplex) Employees: ~150+ Annual Budget: $30–50M |
| Chicago History Museum | · Sep 16, 2026 | Organization: Chicago History Museum (formerly Chicago Historical Society) Location: 1601 N Clark Street, Chicago, IL 60614 Website: chicagohistory.org CEO: Michael J. Anderson, President & CEO Industry: Non-profit / Cultural Institution Breach Date: September 2026 Data Volume: 4 departments + AWS cloud infrastructure, 15+ years of records Individuals Affected: 20,000+ |
| jms building corporation | · Sep 10, 2026 | — |
In the news
AllVictim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .