inc ransom
ransomware group · aka Inc Ransom, IncRansom · unknown (no authoritative public attribution; no confirmed country of operation) · active since 2023-07
Victims · 7d
8▲3 vs prev. week
Victims · 30d
36active targets
Victims · 90d
112
All-time (tracked)
925since 2023-08-09
Last post
09-17 17:39UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
Inc Ransom is a ransomware and data-extortion group first observed in July 2023, known for double extortion using a Tor-hosted leak site. Vendor research links its initial access to exploitation of internet-facing Citrix NetScaler appliances (CVE-2023-3519, CVE-2023-4966). It drew broad attention in March 2024 for the NHS Dumfries and Galloway breach in Scotland and in 2024 for a claimed theft of data from Citrix. Researchers have documented Windows and Linux/ESXi encryptor variants for the group's tooling. Its organizational structure (single crew versus affiliates) and aggregate earnings are not publicly established, and it remains active with intermittent victim postings.
Tactics & tooling
- Initial access via exploitation of unpatched internet-facing Citrix NetScaler ADC/GateWay appliances (CVE-2023-3519; CVE-2023-4966), per vendor reporting
- Data exfiltration before encryption, followed by double extortion on a Tor leak site
- Separate encryptor builds for Windows and for Linux/ESXi environments documented by researchers
- Ransom notes dropped on compromised systems; negotiation via leak-site chat, email, or Tox
- Targets organizations holding sensitive records; healthcare and public-sector victims emphasized in public coverage
- Emphasis on large data volumes in extortion messaging, including claimed terabyte-scale thefts in 2024 reporting
- Organizational model unclear; affiliate involvement not confirmed, so per-incident attribution should be treated cautiously
Targeted sectors
HealthcareGovernment/Public SectorTechnologyManufacturing
Notable public victims
NHS Dumfries and Galloway (Scotland) — March 2024, widely reported; group published stolen data, Citrix — June 2024 claimed breach; the group alleged roughly 1 TB of stolen data, per BleepingComputer (2024), Yamaha Motor Philippines subsidiary — 2023 listing reported in security press, Mediengruppe Thiel (mediengruppethiel.de) — listed on the group leak site, September 2026, per this dashboard, Wellness Partners network — listed on the group leak site, September 2026, per this dashboard
CVEs linked to their intrusions
Estimated earnings
No public figure.
Leak-site victims925 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| TMT Clam Dredger | · Mar 24, 2025 | — |
| allbiz.com | · Mar 24, 2025 | — |
| abeyor.fr | · Mar 23, 2025 | — |
| airtelligence.com | · Mar 19, 2025 | — |
| expertdata.com.au | · Mar 19, 2025 | — |
| gaertnerhof-jeutter.de | · Mar 19, 2025 | — |
| newhollandwood.com | · Mar 19, 2025 | — |
| warmsworth.doncaster.sch.uk | · Mar 19, 2025 | — |
| alphaoil.ca | · Mar 19, 2025 | — |
| Bancroft Wines | · Mar 16, 2025 | — |
| yeanshalle.de | · Mar 16, 2025 | — |
| wmk-hvb.de | · Mar 11, 2025 | — |
| Essex County OB/GYN Associates | · Mar 11, 2025 | — |
| wog-kaiserbaeder.de | · Mar 9, 2025 | — |
| emperors.edu | · Mar 9, 2025 | — |
| BerksBar.org | · Mar 9, 2025 | — |
| williampevear.com | · Mar 9, 2025 | — |
| baldaufarchitekten.de | · Mar 9, 2025 | — |
| State Bar of Texas (www.texasbar.com) | · Mar 9, 2025 | — |
| Greenwood Village South GVS | · Mar 9, 2025 | — |
| Naples Heritage Golf & Country Club | · Mar 6, 2025 | — |
| germancentre.sg | · Mar 2, 2025 | — |
| breakawayconcretecutting.com | · Mar 1, 2025 | — |
| sublettecountywy.gov | · Feb 28, 2025 | — |
| megamtls.com | · Feb 25, 2025 | — |
| evergreenpnw.com | · Feb 22, 2025 | — |
| teamsters175.org | · Feb 22, 2025 | — |
| statesideseattle.com | · Feb 22, 2025 | — |
| californiaclingpeaches.com | · Feb 20, 2025 | — |
| ehdd.com | · Feb 20, 2025 | — |
| pyasolutions.com | · Feb 18, 2025 | — |
| lavi.co.il | · Feb 18, 2025 | — |
| Persante Health Care | · Feb 17, 2025 | — |
| Northeast Delta Human Services Authority | · Feb 15, 2025 | — |
| City of McKinney | · Feb 15, 2025 | — |
| The Children's Center Of Hamden | · Feb 11, 2025 | — |
| air europa | · Jan 29, 2025 | — |
| tnlottery.com | · Jan 29, 2025 | — |
| Boldon James | · Jan 29, 2025 | — |
| Heart to Heart Hospice | · Jan 29, 2025 | — |
| City Of Beloit | · Jan 29, 2025 | — |
| Turning Leaf (TURNINGLEAF.local) | · Jan 29, 2025 | — |
| Menominee Tribal Clinic | · Jan 29, 2025 | — |
| Mission Locale Montpellier | · Jan 29, 2025 | — |
| broward.edu | · Jan 28, 2025 | — |
| cnnindonesia.com | · Jan 28, 2025 | — |
| lhps.org | · Jan 27, 2025 | — |
| Prinston Pharmaceutical (huahaius.com) | · Jan 27, 2025 | — |
| International AIDS Vaccine Initiative (iavi.org) | · Jan 27, 2025 | — |
| starkaerospace.com | · Jan 23, 2025 | — |
In the newsAll →
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .