inc ransom
ransomware group · aka Inc Ransom, IncRansom · unknown (no authoritative public attribution; no confirmed country of operation) · active since 2023-07
Victims · 7d
6▲2 vs prev. week
Victims · 30d
39active targets
Victims · 90d
109
All-time (tracked)
922since 2023-08-09
Last post
09-16 17:44UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
Inc Ransom is a ransomware and data-extortion group first observed in July 2023, known for double extortion using a Tor-hosted leak site. Vendor research links its initial access to exploitation of internet-facing Citrix NetScaler appliances (CVE-2023-3519, CVE-2023-4966). It drew broad attention in March 2024 for the NHS Dumfries and Galloway breach in Scotland and in 2024 for a claimed theft of data from Citrix. Researchers have documented Windows and Linux/ESXi encryptor variants for the group's tooling. Its organizational structure (single crew versus affiliates) and aggregate earnings are not publicly established, and it remains active with intermittent victim postings.
Tactics & tooling
- Initial access via exploitation of unpatched internet-facing Citrix NetScaler ADC/GateWay appliances (CVE-2023-3519; CVE-2023-4966), per vendor reporting
- Data exfiltration before encryption, followed by double extortion on a Tor leak site
- Separate encryptor builds for Windows and for Linux/ESXi environments documented by researchers
- Ransom notes dropped on compromised systems; negotiation via leak-site chat, email, or Tox
- Targets organizations holding sensitive records; healthcare and public-sector victims emphasized in public coverage
- Emphasis on large data volumes in extortion messaging, including claimed terabyte-scale thefts in 2024 reporting
- Organizational model unclear; affiliate involvement not confirmed, so per-incident attribution should be treated cautiously
Targeted sectors
HealthcareGovernment/Public SectorTechnologyManufacturing
Notable public victims
NHS Dumfries and Galloway (Scotland) — March 2024, widely reported; group published stolen data, Citrix — June 2024 claimed breach; the group alleged roughly 1 TB of stolen data, per BleepingComputer (2024), Yamaha Motor Philippines subsidiary — 2023 listing reported in security press, Mediengruppe Thiel (mediengruppethiel.de) — listed on the group leak site, September 2026, per this dashboard, Wellness Partners network — listed on the group leak site, September 2026, per this dashboard
CVEs linked to their intrusions
Estimated earnings
No public figure.
Leak-site victims922 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| hillsidelibrary.org | · Oct 5, 2025 | — |
| stalkerradar.com | · Oct 5, 2025 | — |
| ocmaine.com | · Oct 5, 2025 | — |
| stockmeier-urethanes.com | · Oct 3, 2025 | — |
| suntreeinternalmedicine.com | · Oct 2, 2025 | — |
| Climatron | · Oct 1, 2025 | — |
| callhci.com | · Oct 1, 2025 | — |
| icc-nw.net | · Oct 1, 2025 | — |
| Cholakyan Chiropractic | · Oct 1, 2025 | — |
| LAMMCO.NET | · Oct 1, 2025 | — |
| idealbathrooms.ie | · Oct 1, 2025 | — |
| Nacsworld.com | · Oct 1, 2025 | — |
| Manjarrez Impresores | · Sep 29, 2025 | — |
| phi.ca | · Sep 29, 2025 | — |
| awo-ka-land.de | · Sep 25, 2025 | — |
| TLD Law.com | · Sep 24, 2025 | — |
| Speed Art Museum | · Sep 23, 2025 | — |
| P&P Industries | · Sep 23, 2025 | — |
| CPK Interior | · Sep 22, 2025 | — |
| Pennsylvania Office of Attorney General | · Sep 21, 2025 | — |
| cardiofocus.com | · Sep 18, 2025 | — |
| cardinal-services.com | · Sep 18, 2025 | — |
| grupogid.com | · Sep 18, 2025 | — |
| lindenlaw.com | · Sep 18, 2025 | — |
| https://www.cnh.com/ | · Sep 17, 2025 | — |
| Humax Holdings | · Sep 17, 2025 | — |
| jsgroup | · Sep 15, 2025 | — |
| Venlogistics | · Sep 15, 2025 | — |
| Technology Assurance Group | · Sep 15, 2025 | — |
| www.roscovision.com | · Sep 15, 2025 | — |
| http://www.hiec.com/ | · Sep 15, 2025 | — |
| https://heritagegrowth.com/ | · Sep 15, 2025 | — |
| BRIGHT SYSTEM JAPAN CO., LTD | · Sep 13, 2025 | — |
| CBL-SRL | · Sep 13, 2025 | — |
| deerfield.com / singulargenomics.com | · Sep 11, 2025 | — |
| transnova-ruf.de | · Sep 11, 2025 | — |
| www.melenco.com | · Sep 10, 2025 | — |
| Republica De Panama | · Sep 9, 2025 | — |
| Miesa | · Sep 9, 2025 | — |
| schuler-service-group.de | · Sep 6, 2025 | — |
| Monterey Mushrooms, LLC | · Sep 5, 2025 | — |
| cphcorp.com | · Sep 4, 2025 | — |
| sandg.local | · Sep 4, 2025 | — |
| omegabiotek.com | · Sep 4, 2025 | — |
| CANDhenterprises.com | · Sep 4, 2025 | — |
| stthom.edu | · Sep 3, 2025 | — |
| Commission scolaire des Appalaches | · Sep 3, 2025 | — |
| CESCONSULT | · Sep 3, 2025 | — |
| Bartek Ingredients | · Sep 2, 2025 | — |
| TAK Communications, Inc | · Sep 1, 2025 | — |
In the newsAll →
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .