inc ransom
ransomware group · aka Inc Ransom, IncRansom · unknown (no authoritative public attribution; no confirmed country of operation) · active since 2023-07
Victims · 7d
8▲3 vs prev. week
Victims · 30d
36active targets
Victims · 90d
112
All-time (tracked)
925since 2023-08-09
Last post
09-17 17:39UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
Inc Ransom is a ransomware and data-extortion group first observed in July 2023, known for double extortion using a Tor-hosted leak site. Vendor research links its initial access to exploitation of internet-facing Citrix NetScaler appliances (CVE-2023-3519, CVE-2023-4966). It drew broad attention in March 2024 for the NHS Dumfries and Galloway breach in Scotland and in 2024 for a claimed theft of data from Citrix. Researchers have documented Windows and Linux/ESXi encryptor variants for the group's tooling. Its organizational structure (single crew versus affiliates) and aggregate earnings are not publicly established, and it remains active with intermittent victim postings.
Tactics & tooling
- Initial access via exploitation of unpatched internet-facing Citrix NetScaler ADC/GateWay appliances (CVE-2023-3519; CVE-2023-4966), per vendor reporting
- Data exfiltration before encryption, followed by double extortion on a Tor leak site
- Separate encryptor builds for Windows and for Linux/ESXi environments documented by researchers
- Ransom notes dropped on compromised systems; negotiation via leak-site chat, email, or Tox
- Targets organizations holding sensitive records; healthcare and public-sector victims emphasized in public coverage
- Emphasis on large data volumes in extortion messaging, including claimed terabyte-scale thefts in 2024 reporting
- Organizational model unclear; affiliate involvement not confirmed, so per-incident attribution should be treated cautiously
Targeted sectors
HealthcareGovernment/Public SectorTechnologyManufacturing
Notable public victims
NHS Dumfries and Galloway (Scotland) — March 2024, widely reported; group published stolen data, Citrix — June 2024 claimed breach; the group alleged roughly 1 TB of stolen data, per BleepingComputer (2024), Yamaha Motor Philippines subsidiary — 2023 listing reported in security press, Mediengruppe Thiel (mediengruppethiel.de) — listed on the group leak site, September 2026, per this dashboard, Wellness Partners network — listed on the group leak site, September 2026, per this dashboard
CVEs linked to their intrusions
Estimated earnings
No public figure.
Leak-site victims925 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| RETAL Baltic Films | · Jan 21, 2025 | — |
| Washington Gastroenterology (DHSWA.NET) | · Jan 17, 2025 | — |
| Kilgore College (kilgore.edu) | · Jan 17, 2025 | — |
| peponline.org | · Jan 17, 2025 | — |
| Taylor Regional Hospital (thcg.local) | · Jan 17, 2025 | — |
| Regina Coeli Convent | · Jan 17, 2025 | — |
| Riverina Medical | · Jan 14, 2025 | — |
| Spectrum | · Jan 14, 2025 | — |
| Imperial Valley Respite (ivrespite.com) | · Jan 13, 2025 | — |
| Biomedical Caledonia Medical Laboratory (calmedlab.local) | · Jan 13, 2025 | — |
| Onecare | · Jan 13, 2025 | — |
| Findhelp Information Services | · Jan 13, 2025 | — |
| depewgillen.com | · Jan 9, 2025 | — |
| fwmep.edu | · Jan 8, 2025 | — |
| Youth Eastside Services | · Dec 28, 2024 | — |
| falp.org | · Dec 27, 2024 | — |
| Inner City Family Health Team (ICFHT.local) | · Dec 27, 2024 | — |
| Primary Health Services Center | · Dec 27, 2024 | — |
| Haji Husein Alireza | · Dec 10, 2024 | — |
| Black Creek Community Health Centre (bcch.local) | · Dec 7, 2024 | — |
| Arc Community Services Inc | · Dec 7, 2024 | — |
| McKibbin | · Dec 1, 2024 | — |
| NHS Alder Hey | · Nov 28, 2024 | — |
| visufarma.com | · Nov 28, 2024 | — |
| formpipe.com | · Nov 27, 2024 | — |
| Hadwins Volkswagen | · Nov 25, 2024 | — |
| borohradek | · Nov 25, 2024 | — |
| atfservices.com.au | · Nov 25, 2024 | — |
| aclaser.com.au | · Nov 25, 2024 | — |
| Nicholsons Solicitors | · Nov 24, 2024 | — |
| Pastor Real Estate | · Nov 24, 2024 | — |
| Sa.SS Datentechnik | · Nov 24, 2024 | — |
| Service Avicole JGL | · Nov 23, 2024 | — |
| Darlington EMS | · Nov 23, 2024 | — |
| Schuck-Gruppe | · Nov 23, 2024 | — |
| IPE Engwicht | · Nov 23, 2024 | — |
| Alna-Bioscience | · Nov 23, 2024 | — |
| Brueck Golosow Kim & Associates | · Nov 21, 2024 | — |
| Goldsmith & Hull | · Nov 21, 2024 | — |
| United Bakery Equipment | · Nov 21, 2024 | — |
| Zimmerei Buder | · Nov 21, 2024 | — |
| PBS AEROSPACE | · Nov 20, 2024 | — |
| PHARMATIS-SAS | · Nov 15, 2024 | — |
| vbuzrt.hu | · Nov 8, 2024 | — |
| ucv.es | · Nov 7, 2024 | — |
| europe-qualité | · Nov 7, 2024 | — |
| Webb Institute | · Nov 5, 2024 | — |
| San Francisco Ballet | · Nov 4, 2024 | — |
| Doctors Regional Cancer Center | · Oct 10, 2024 | — |
| Storck-Baugesellschaft mbH | · Oct 5, 2024 | — |
In the newsAll →
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .