inc ransom
ransomware group · aka Inc Ransom, IncRansom · unknown (no authoritative public attribution; no confirmed country of operation) · active since 2023-07
Victims · 7d
9▲5 vs prev. week
Victims · 30d
36active targets
Victims · 90d
112
All-time (tracked)
925since 2023-08-09
Last post
09-17 17:39UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
Inc Ransom is a ransomware and data-extortion group first observed in July 2023, known for double extortion using a Tor-hosted leak site. Vendor research links its initial access to exploitation of internet-facing Citrix NetScaler appliances (CVE-2023-3519, CVE-2023-4966). It drew broad attention in March 2024 for the NHS Dumfries and Galloway breach in Scotland and in 2024 for a claimed theft of data from Citrix. Researchers have documented Windows and Linux/ESXi encryptor variants for the group's tooling. Its organizational structure (single crew versus affiliates) and aggregate earnings are not publicly established, and it remains active with intermittent victim postings.
Tactics & tooling
- Initial access via exploitation of unpatched internet-facing Citrix NetScaler ADC/GateWay appliances (CVE-2023-3519; CVE-2023-4966), per vendor reporting
- Data exfiltration before encryption, followed by double extortion on a Tor leak site
- Separate encryptor builds for Windows and for Linux/ESXi environments documented by researchers
- Ransom notes dropped on compromised systems; negotiation via leak-site chat, email, or Tox
- Targets organizations holding sensitive records; healthcare and public-sector victims emphasized in public coverage
- Emphasis on large data volumes in extortion messaging, including claimed terabyte-scale thefts in 2024 reporting
- Organizational model unclear; affiliate involvement not confirmed, so per-incident attribution should be treated cautiously
Targeted sectors
HealthcareGovernment/Public SectorTechnologyManufacturing
Notable public victims
NHS Dumfries and Galloway (Scotland) — March 2024, widely reported; group published stolen data, Citrix — June 2024 claimed breach; the group alleged roughly 1 TB of stolen data, per BleepingComputer (2024), Yamaha Motor Philippines subsidiary — 2023 listing reported in security press, Mediengruppe Thiel (mediengruppethiel.de) — listed on the group leak site, September 2026, per this dashboard, Wellness Partners network — listed on the group leak site, September 2026, per this dashboard
CVEs linked to their intrusions
Estimated earnings
No public figure.
Leak-site victims925 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| MTTEXPERTISES.COM | · Jun 6, 2025 | — |
| Nunez Dental | · Jun 6, 2025 | — |
| iscamen | · Jun 5, 2025 | — |
| cemeteries.local | · Jun 4, 2025 | — |
| Funktel GmbH | · Jun 4, 2025 | — |
| Sandhills Medical Foundation | · Jun 3, 2025 | — |
| valuestoreit | · Jun 2, 2025 | — |
| Universidad Técnica del Norte Ecuador | · Jun 2, 2025 | — |
| sitro.com.au | · May 31, 2025 | — |
| mysfa.org | · May 31, 2025 | — |
| Jordan Drug | · May 30, 2025 | — |
| oxparkrec.org | · May 26, 2025 | — |
| piercecountylibrary.org | · May 22, 2025 | — |
| Rivers Academy West London | · May 21, 2025 | — |
| The Vascular Experts | · May 20, 2025 | — |
| nissi-beach.com | · May 16, 2025 | — |
| finanzconsult-immobilien.de | · May 16, 2025 | — |
| www.davisdavisco.com | · May 16, 2025 | — |
| alpha-steuer.de | · May 16, 2025 | — |
| npfy.org | · May 16, 2025 | — |
| ros.eu | · May 16, 2025 | — |
| ccrcda.org | · May 16, 2025 | — |
| south african airways (flysaa.com) | · May 16, 2025 | — |
| GARDNER ORTHOPEDICS | · May 15, 2025 | — |
| StudioVaiani | · May 1, 2025 | — |
| The Saint James Hospital Group | · May 1, 2025 | — |
| Hpital Glengarry Memorial Hospital (clglen.local) | · May 1, 2025 | — |
| arkansasprimarycare.com | · Apr 24, 2025 | — |
| lemi-group | · Apr 23, 2025 | — |
| franklin nursing home | · Apr 22, 2025 | — |
| Koninklijke Ahold Delhaize N.V. | · Apr 17, 2025 | — |
| iblinfo.de | · Apr 16, 2025 | — |
| trocaire.edu | · Apr 15, 2025 | — |
| Orthopaedic Specialists of Connecticut | · Apr 14, 2025 | — |
| MENTAL HEALTH | · Apr 14, 2025 | — |
| Chickenshed | · Apr 12, 2025 | — |
| Imagineering Finishing Technologies | · Apr 11, 2025 | — |
| inspec-international.com | · Apr 10, 2025 | — |
| silocaf.com | · Apr 10, 2025 | — |
| chesterfieldtwp.org | · Apr 10, 2025 | — |
| finetech.de | · Apr 10, 2025 | — |
| ccso2014.local(sheriffs) | · Apr 9, 2025 | — |
| Coop57 | · Apr 8, 2025 | — |
| Thiekon Constructie | · Apr 8, 2025 | — |
| The Loretto Hospital | · Apr 1, 2025 | — |
| importantsteps.com | · Mar 29, 2025 | — |
| bahnlog.com | · Mar 29, 2025 | — |
| augustssons.se | · Mar 28, 2025 | — |
| City of Fort St. John (city.cityfsj.local) | · Mar 27, 2025 | — |
| TriCity Family Services | · Mar 26, 2025 | — |
In the newsAll →
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .