inc ransom
ransomware group · aka Inc Ransom, IncRansom · unknown (no authoritative public attribution; no confirmed country of operation) · active since 2023-07
Victims · 7d
8▲3 vs prev. week
Victims · 30d
36active targets
Victims · 90d
112
All-time (tracked)
925since 2023-08-09
Last post
09-17 17:39UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
Inc Ransom is a ransomware and data-extortion group first observed in July 2023, known for double extortion using a Tor-hosted leak site. Vendor research links its initial access to exploitation of internet-facing Citrix NetScaler appliances (CVE-2023-3519, CVE-2023-4966). It drew broad attention in March 2024 for the NHS Dumfries and Galloway breach in Scotland and in 2024 for a claimed theft of data from Citrix. Researchers have documented Windows and Linux/ESXi encryptor variants for the group's tooling. Its organizational structure (single crew versus affiliates) and aggregate earnings are not publicly established, and it remains active with intermittent victim postings.
Tactics & tooling
- Initial access via exploitation of unpatched internet-facing Citrix NetScaler ADC/GateWay appliances (CVE-2023-3519; CVE-2023-4966), per vendor reporting
- Data exfiltration before encryption, followed by double extortion on a Tor leak site
- Separate encryptor builds for Windows and for Linux/ESXi environments documented by researchers
- Ransom notes dropped on compromised systems; negotiation via leak-site chat, email, or Tox
- Targets organizations holding sensitive records; healthcare and public-sector victims emphasized in public coverage
- Emphasis on large data volumes in extortion messaging, including claimed terabyte-scale thefts in 2024 reporting
- Organizational model unclear; affiliate involvement not confirmed, so per-incident attribution should be treated cautiously
Targeted sectors
HealthcareGovernment/Public SectorTechnologyManufacturing
Notable public victims
NHS Dumfries and Galloway (Scotland) — March 2024, widely reported; group published stolen data, Citrix — June 2024 claimed breach; the group alleged roughly 1 TB of stolen data, per BleepingComputer (2024), Yamaha Motor Philippines subsidiary — 2023 listing reported in security press, Mediengruppe Thiel (mediengruppethiel.de) — listed on the group leak site, September 2026, per this dashboard, Wellness Partners network — listed on the group leak site, September 2026, per this dashboard
CVEs linked to their intrusions
Estimated earnings
No public figure.
Leak-site victims925 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| Quantum Healthcare | · Oct 2, 2024 | — |
| Divine Interprises INC | · Sep 29, 2024 | — |
| DINAS Corp | · Sep 29, 2024 | — |
| Direct Access Partners | · Sep 28, 2024 | — |
| Visionary Homes | · Sep 20, 2024 | — |
| Nusser Mineralöl GmbH | · Sep 19, 2024 | — |
| OnePoint Patient Care | · Sep 15, 2024 | — |
| Cathedral Prep (villalan.edu) | · Sep 11, 2024 | — |
| Regent Care Center | · Sep 11, 2024 | — |
| E-Z Pack Holdings LLC | · Sep 10, 2024 | — |
| San Francisco Sheriff's Department (sjcso.local) | · Sep 2, 2024 | — |
| ERoko Distributors + Colonial Countertops | · Sep 2, 2024 | — |
| The University and College Union | · Aug 25, 2024 | — |
| Health Quality Council | · Aug 24, 2024 | — |
| HL Lawson & Sons | · Aug 24, 2024 | — |
| Don’t Waste Group | · Aug 22, 2024 | — |
| Larc | · Aug 22, 2024 | — |
| Boombah Inc. | · Aug 9, 2024 | — |
| HP Distribution | · Aug 5, 2024 | — |
| Norther n Bedford County School District (nbcsc.org) | · Jul 25, 2024 | — |
| maingroup | · Jul 23, 2024 | — |
| Association Management Strategies(AAMC.local) | · Jul 23, 2024 | — |
| CIMP.COM | · Jul 23, 2024 | — |
| A.L.P. Lighting Components | · Jul 17, 2024 | — |
| The Coffee Bean & Tea Leaf | · Jul 13, 2024 | — |
| State of Alabama - Alabama Department Of Education | · Jul 13, 2024 | — |
| erne | · Jul 13, 2024 | — |
| REPLIGEN | · Jul 9, 2024 | — |
| Guhring USA | · Jul 8, 2024 | — |
| Center for Human Capital Innovation (centerforhci.org) | · Jul 5, 2024 | — |
| waupacacounty-wi.gov | · Jul 5, 2024 | — |
| waupaca.wi.us | · Jul 5, 2024 | — |
| a4hs-dom.local | · Jun 30, 2024 | — |
| Puyallup Tribe (ptoi.local) | · Jun 29, 2024 | — |
| City Of Coon Rapids | · Jun 29, 2024 | — |
| Cambridge University Press & Assessment | · Jun 29, 2024 | — |
| GBA GROUP | · Jun 28, 2024 | — |
| Planar | · Jun 25, 2024 | — |
| middletown-township.org | · Jun 25, 2024 | — |
| Maryhaven (MHCLINICAL.LOCAL) | · Jun 22, 2024 | — |
| Sacred Heart Community Service (shcstheheart.org) | · Jun 20, 2024 | — |
| Gorrie-Regan | · Jun 20, 2024 | — |
| Behavioral Health Response (bhr.local) | · Jun 19, 2024 | — |
| DERBY SCHOOL | · Jun 19, 2024 | — |
| OCEANAIR | · Jun 17, 2024 | — |
| Sensory Spectrum | · Jun 17, 2024 | — |
| Kito Canada | · Jun 13, 2024 | — |
| Rockford Public School District | · Jun 10, 2024 | — |
| CONTROLNET | · Jun 10, 2024 | — |
| aloft | · Jun 7, 2024 | — |
In the newsAll →
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .