inc ransom
ransomware group · aka Inc Ransom, IncRansom · unknown (no authoritative public attribution; no confirmed country of operation) · active since 2023-07
Victims · 7d
6▲2 vs prev. week
Victims · 30d
39active targets
Victims · 90d
109
All-time (tracked)
922since 2023-08-09
Last post
09-16 17:44UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
Inc Ransom is a ransomware and data-extortion group first observed in July 2023, known for double extortion using a Tor-hosted leak site. Vendor research links its initial access to exploitation of internet-facing Citrix NetScaler appliances (CVE-2023-3519, CVE-2023-4966). It drew broad attention in March 2024 for the NHS Dumfries and Galloway breach in Scotland and in 2024 for a claimed theft of data from Citrix. Researchers have documented Windows and Linux/ESXi encryptor variants for the group's tooling. Its organizational structure (single crew versus affiliates) and aggregate earnings are not publicly established, and it remains active with intermittent victim postings.
Tactics & tooling
- Initial access via exploitation of unpatched internet-facing Citrix NetScaler ADC/GateWay appliances (CVE-2023-3519; CVE-2023-4966), per vendor reporting
- Data exfiltration before encryption, followed by double extortion on a Tor leak site
- Separate encryptor builds for Windows and for Linux/ESXi environments documented by researchers
- Ransom notes dropped on compromised systems; negotiation via leak-site chat, email, or Tox
- Targets organizations holding sensitive records; healthcare and public-sector victims emphasized in public coverage
- Emphasis on large data volumes in extortion messaging, including claimed terabyte-scale thefts in 2024 reporting
- Organizational model unclear; affiliate involvement not confirmed, so per-incident attribution should be treated cautiously
Targeted sectors
HealthcareGovernment/Public SectorTechnologyManufacturing
Notable public victims
NHS Dumfries and Galloway (Scotland) — March 2024, widely reported; group published stolen data, Citrix — June 2024 claimed breach; the group alleged roughly 1 TB of stolen data, per BleepingComputer (2024), Yamaha Motor Philippines subsidiary — 2023 listing reported in security press, Mediengruppe Thiel (mediengruppethiel.de) — listed on the group leak site, September 2026, per this dashboard, Wellness Partners network — listed on the group leak site, September 2026, per this dashboard
CVEs linked to their intrusions
Estimated earnings
No public figure.
Leak-site victims922 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| OB GYN Associates | · Aug 30, 2025 | — |
| www.sbdl.net | · Aug 29, 2025 | — |
| Manesa | · Aug 29, 2025 | — |
| BDO Perú | · Aug 29, 2025 | — |
| CPK Interior Products Inc | · Aug 29, 2025 | — |
| Kafka Conveyors & Equipment Inc | · Aug 28, 2025 | — |
| climaxportable.com | · Aug 28, 2025 | — |
| allmaxnutrition.com | · Aug 27, 2025 | — |
| marlboroughpartners.com | · Aug 26, 2025 | — |
| Security First Credit Union | · Aug 26, 2025 | — |
| Quadrangle Imaging Center | · Aug 22, 2025 | — |
| Universal Group For Engineering and Consulting | · Aug 21, 2025 | — |
| EUROFILM ΜΑΝΤΖΑΡΗΣ Α.Ε | · Aug 20, 2025 | — |
| Netstar_South_Africa | · Aug 20, 2025 | — |
| mycpaconnection.com | · Aug 17, 2025 | — |
| MJets | · Aug 15, 2025 | — |
| Töller | · Aug 15, 2025 | — |
| Louis Tieu DDS MD | · Aug 11, 2025 | — |
| Howard Financial & Associates | · Aug 10, 2025 | — |
| multichem.net | · Aug 8, 2025 | — |
| Afpa | · Aug 6, 2025 | — |
| Consumer Electronics & Computers Retail Retail | · Aug 6, 2025 | — |
| Carrollton Ear Nose and Throat | · Aug 5, 2025 | — |
| Radford City Schools | · Aug 1, 2025 | — |
| carolynmyoung.com | · Jul 31, 2025 | — |
| wvpca.org | · Jul 31, 2025 | — |
| erichschleichgmbh.de | · Jul 31, 2025 | — |
| deliastamales.com | · Jul 31, 2025 | — |
| whiteconlee.com | · Jul 31, 2025 | — |
| firstpresatl.org | · Jul 31, 2025 | — |
| lynkspot.com | · Jul 31, 2025 | — |
| Devon | · Jul 31, 2025 | — |
| fsl.org | · Jul 30, 2025 | — |
| Dollar Tree | · Jul 30, 2025 | — |
| www.v4ulogistic.com/ Leaked by www.etornetworks.com | · Jul 29, 2025 | — |
| seasonsfour.com | · Jul 25, 2025 | — |
| teampostop.net | · Jul 25, 2025 | — |
| Sementes Jotabasso | · Jul 23, 2025 | — |
| www.reliablecontrols.com | · Jul 22, 2025 | — |
| TOMEI GROUP Inc. | · Jul 22, 2025 | — |
| reizenlaw.com | · Jul 22, 2025 | — |
| neues-leben.de | · Jul 22, 2025 | — |
| asi-group.com | · Jul 22, 2025 | — |
| hitachi-tds.com | · Jul 22, 2025 | — |
| dtxstudio.com | · Jul 22, 2025 | — |
| heartlineoklahoma.org | · Jul 22, 2025 | — |
| csaas.com | · Jul 22, 2025 | — |
| nboat.com | · Jul 22, 2025 | — |
| scaffoldsolutions.com | · Jul 22, 2025 | — |
| erniesinceresco.com | · Jul 19, 2025 | — |
In the newsAll →
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .