inc ransom
ransomware group · aka Inc Ransom, IncRansom · unknown (no authoritative public attribution; no confirmed country of operation) · active since 2023-07
Victims · 7d
9▲5 vs prev. week
Victims · 30d
36active targets
Victims · 90d
112
All-time (tracked)
925since 2023-08-09
Last post
09-17 17:39UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
Inc Ransom is a ransomware and data-extortion group first observed in July 2023, known for double extortion using a Tor-hosted leak site. Vendor research links its initial access to exploitation of internet-facing Citrix NetScaler appliances (CVE-2023-3519, CVE-2023-4966). It drew broad attention in March 2024 for the NHS Dumfries and Galloway breach in Scotland and in 2024 for a claimed theft of data from Citrix. Researchers have documented Windows and Linux/ESXi encryptor variants for the group's tooling. Its organizational structure (single crew versus affiliates) and aggregate earnings are not publicly established, and it remains active with intermittent victim postings.
Tactics & tooling
- Initial access via exploitation of unpatched internet-facing Citrix NetScaler ADC/GateWay appliances (CVE-2023-3519; CVE-2023-4966), per vendor reporting
- Data exfiltration before encryption, followed by double extortion on a Tor leak site
- Separate encryptor builds for Windows and for Linux/ESXi environments documented by researchers
- Ransom notes dropped on compromised systems; negotiation via leak-site chat, email, or Tox
- Targets organizations holding sensitive records; healthcare and public-sector victims emphasized in public coverage
- Emphasis on large data volumes in extortion messaging, including claimed terabyte-scale thefts in 2024 reporting
- Organizational model unclear; affiliate involvement not confirmed, so per-incident attribution should be treated cautiously
Targeted sectors
HealthcareGovernment/Public SectorTechnologyManufacturing
Notable public victims
NHS Dumfries and Galloway (Scotland) — March 2024, widely reported; group published stolen data, Citrix — June 2024 claimed breach; the group alleged roughly 1 TB of stolen data, per BleepingComputer (2024), Yamaha Motor Philippines subsidiary — 2023 listing reported in security press, Mediengruppe Thiel (mediengruppethiel.de) — listed on the group leak site, September 2026, per this dashboard, Wellness Partners network — listed on the group leak site, September 2026, per this dashboard
CVEs linked to their intrusions
Estimated earnings
No public figure.
Leak-site victims925 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| nboat.com | · Jul 22, 2025 | — |
| scaffoldsolutions.com | · Jul 22, 2025 | — |
| erniesinceresco.com | · Jul 19, 2025 | — |
| Wingpoh_SG | · Jul 17, 2025 | — |
| Crompton Lamps, UK | · Jul 17, 2025 | — |
| HTC_Högtryckscenter_Sweden | · Jul 17, 2025 | — |
| Huize Sint-Augustinus_BE | · Jul 17, 2025 | — |
| Vitec | · Jul 17, 2025 | — |
| Сomet-strip-enterprises-ltd | · Jul 17, 2025 | — |
| TERENCE C RINGLAND & CO PTY LTD | · Jul 17, 2025 | — |
| Secountryvets_AU | · Jul 17, 2025 | — |
| Otjiwarongo Municipality | · Jul 15, 2025 | — |
| www.marvimundo.com | · Jul 15, 2025 | — |
| CF Construction Ltd | · Jul 15, 2025 | — |
| dwllp.ca/ Leaked by www.etornetworks.com | · Jul 14, 2025 | — |
| lstlaw.ca/ Leaked by www.etornetworks.com | · Jul 14, 2025 | — |
| Trilinklogistics Inc / Leacked by www.etornetworks.com/ | · Jul 14, 2025 | — |
| National Institute of Water Resources | · Jul 14, 2025 | — |
| k12albemarle.org | · Jul 12, 2025 | — |
| bayviewci.org | · Jul 10, 2025 | — |
| communitycareresources.com | · Jul 10, 2025 | — |
| brennytransportation.com | · Jul 10, 2025 | — |
| tiergesundheitszentrum-koenigslutter.de | · Jul 10, 2025 | — |
| Lamberts Business Systems | · Jul 9, 2025 | — |
| TBC | · Jul 9, 2025 | — |
| Majestic | · Jul 9, 2025 | — |
| tsaworld.com | · Jul 7, 2025 | — |
| jubileejobs.org | · Jul 7, 2025 | — |
| cityofgardendale.com | · Jul 4, 2025 | — |
| C B King Memorial School(branch) | · Jul 4, 2025 | — |
| alereon.com | · Jul 2, 2025 | — |
| coruzcitywndata+ | · Jul 1, 2025 | — |
| The Kingdom of Tonga's Ministry of Health | · Jun 27, 2025 | — |
| Medical Center of Marin | · Jun 25, 2025 | — |
| Fund for Reformed Companies (FONPER) | · Jun 25, 2025 | — |
| OAK PARK & RIVER FOREST HIGH SCHOOL | · Jun 21, 2025 | — |
| doradosoftware.com | · Jun 21, 2025 | — |
| AFECC - Hospital Santa Rita de Cássia | · Jun 19, 2025 | — |
| Morar Construtora e Incorporadora LTDA | · Jun 19, 2025 | — |
| https://www.ilesfuneralhomes.com/ | · Jun 19, 2025 | — |
| New Jersey Association on Correction | · Jun 18, 2025 | — |
| West Texas Oral and Facial Surgery | · Jun 18, 2025 | — |
| Academic Urology & Urogynecology of Arizona | · Jun 17, 2025 | — |
| Lamina Dielectrics, United Kingdom | · Jun 17, 2025 | — |
| Sandhill View County School_UK | · Jun 17, 2025 | — |
| Durant City | · Jun 17, 2025 | — |
| alleray-labrouste | · Jun 12, 2025 | — |
| Mount Rogers Community Services | · Jun 10, 2025 | — |
| waiwhetu-medical-centre | · Jun 7, 2025 | — |
| Kittery Police Department | · Jun 6, 2025 | — |
In the newsAll →
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .