inc ransom
ransomware group · aka Inc Ransom, IncRansom · unknown (no authoritative public attribution; no confirmed country of operation) · active since 2023-07
Victims · 7d
8▲4 vs prev. week
Victims · 30d
36active targets
Victims · 90d
112
All-time (tracked)
925since 2023-08-09
Last post
09-17 17:39UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
Inc Ransom is a ransomware and data-extortion group first observed in July 2023, known for double extortion using a Tor-hosted leak site. Vendor research links its initial access to exploitation of internet-facing Citrix NetScaler appliances (CVE-2023-3519, CVE-2023-4966). It drew broad attention in March 2024 for the NHS Dumfries and Galloway breach in Scotland and in 2024 for a claimed theft of data from Citrix. Researchers have documented Windows and Linux/ESXi encryptor variants for the group's tooling. Its organizational structure (single crew versus affiliates) and aggregate earnings are not publicly established, and it remains active with intermittent victim postings.
Tactics & tooling
- Initial access via exploitation of unpatched internet-facing Citrix NetScaler ADC/GateWay appliances (CVE-2023-3519; CVE-2023-4966), per vendor reporting
- Data exfiltration before encryption, followed by double extortion on a Tor leak site
- Separate encryptor builds for Windows and for Linux/ESXi environments documented by researchers
- Ransom notes dropped on compromised systems; negotiation via leak-site chat, email, or Tox
- Targets organizations holding sensitive records; healthcare and public-sector victims emphasized in public coverage
- Emphasis on large data volumes in extortion messaging, including claimed terabyte-scale thefts in 2024 reporting
- Organizational model unclear; affiliate involvement not confirmed, so per-incident attribution should be treated cautiously
Targeted sectors
HealthcareGovernment/Public SectorTechnologyManufacturing
Notable public victims
NHS Dumfries and Galloway (Scotland) — March 2024, widely reported; group published stolen data, Citrix — June 2024 claimed breach; the group alleged roughly 1 TB of stolen data, per BleepingComputer (2024), Yamaha Motor Philippines subsidiary — 2023 listing reported in security press, Mediengruppe Thiel (mediengruppethiel.de) — listed on the group leak site, September 2026, per this dashboard, Wellness Partners network — listed on the group leak site, September 2026, per this dashboard
CVEs linked to their intrusions
Estimated earnings
No public figure.
Leak-site victims925 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| Crandall ISD (CISD.crandallisd.org) | · Jun 5, 2024 | — |
| Access Sports Medicine & Orthopaedics | · May 25, 2024 | — |
| Audubon Nature Institute (auduboninstitute.org) | · May 24, 2024 | — |
| Hands TheFamilyHelpNetwork.ca | · May 23, 2024 | — |
| Midwest Covenant Home | · May 23, 2024 | — |
| First Nations Health Authority (fnha.local) | · May 23, 2024 | — |
| Richland City Hall | · May 23, 2024 | — |
| William S. Hein & Co. | · May 21, 2024 | — |
| allied-mechanical-services-inc | · May 20, 2024 | — |
| Regional Obstetrical Consultants | · May 20, 2024 | — |
| Delano Adult School (DJUHSD.ORG) | · May 20, 2024 | — |
| Specialty Market Managers | · May 20, 2024 | — |
| Sterling Transportation Services (sts.local) | · May 20, 2024 | — |
| Continuing Healthcare Solutions (chs.local) | · May 20, 2024 | — |
| California Highway Patrol (SVEL237.org) | · May 20, 2024 | — |
| drmsusa.com | · May 18, 2024 | — |
| aharvey.nf.ca | · May 17, 2024 | — |
| gravetye-manor | · May 16, 2024 | — |
| Talley Group | · May 16, 2024 | — |
| Eden Project Ltd | · May 13, 2024 | — |
| Helapet Ltd | · May 13, 2024 | — |
| Seaman's Mechanical | · May 13, 2024 | — |
| Deeside Timberframe | · May 13, 2024 | — |
| NHS (press update) | · May 12, 2024 | After the first post on our blog, we contacted the NHS administration for a month by phone and email urging them to negotiate. In response, we received laughter and statements that they didn't care... |
| Pinnacle Orthopaedics | · May 9, 2024 | — |
| Softura | · May 9, 2024 | — |
| Electric Mirror Inc | · May 8, 2024 | Electric Mirror is in more hotels than all of our competitors combined, making us the leader in Lighted Mirrors and Mirror TV technology. Since we first introduced Lighted Mirrors and Mirror TVs to... |
| Fribin | · May 8, 2024 | — |
| Electric Mirror | · May 8, 2024 | — |
| City of Buckeye (buckeyeaz.gov) | · May 7, 2024 | — |
| JFK Financial Inc. | · May 7, 2024 | JFK Financial Inc. is a national mortgage lender offering a wide variety of loan programs, services, powerful online tools, and all with unparalleled customer service. For almost 20 years, JFK has... |
| Seneca Nation Health System | · May 6, 2024 | — |
| Mainline Health Systems (MHS.local) | · May 4, 2024 | — |
| US-Saudi Arabian Business Council | · May 3, 2024 | — |
| It4 Solutions Robras Corp | · May 1, 2024 | — |
| Trylon Srl | · May 1, 2024 | — |
| Sobieski Services Inc | · May 1, 2024 | — |
| INC News | · May 1, 2024 | We moved to another blog. TOR: http://incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad.onion/ WWW: http://incblog.su/ This one will be closed in 2-3 months. |
| Human Technology Inc. | · Apr 27, 2024 | Innovative prosthetics and orthotics combined with clinical expertise and unparalleled patient care – at Human Technology, we are committed to your well-being, your unique needs, and your desire to... |
| Continuing Healthcare Solutions | · Apr 20, 2024 | The mission of Continuing Healthcare Solutions is to provide our residents with exceptional care and treat them with the highest levels of dignity and respect. This demands a commitment to building... |
| Lutheran Social Services of Indiana | · Apr 20, 2024 | As an organization accredited by the Council on Accreditation, Lutheran Social Services of Indiana adheres to the highest standard of best practices while providing quality services to those we... |
| Delano Joint Union High School District | · Apr 17, 2024 | The Delano Joint Union High School District is a District of rich tradition, high expectations, and a century of outstanding achievement. Delano High School began in 1911 with fourteen students and... |
| Druckman Law Group | · Apr 15, 2024 | Druckman Law Group PLLC is a law firm in Westbury, New York, that provides real estate transactions and litigation. We provide our services to the state of New York, representing lenders and mortgage... |
| Pulaski academy | · Apr 15, 2024 | Pulaski Academy offers a unique and distinctive college preparatory educational experience. Whether you are just beginning to research the options for your child's education, are looking for a new... |
| Henningson & Snoxell, Ltd. | · Apr 11, 2024 | Located in Maple Grove, Minnesota, Henningson & Snoxell has served businesses and individuals throughout the Minneapolis-St. Paul Metro area and beyond since 1981. Our suburban law firm combines... |
| Community Alliance | · Apr 11, 2024 | About Community Alliance:- Community Alliance offers a full continuum of behavioral health services including psychiatric care, counseling, psycho-social rehabilitation services (for those with... |
| Remitano - Cryptocurrency Exchange | · Apr 4, 2024 | Remitano App is an Escrowed P2P Cryptocurrency Exchange. We help you easily Buy - Sell - Store - Invest - Deposit & Withdraw cryptocurrencies with Fiat Wallet FAST & SECURELY. Our app supports... |
| West Idaho Orthopedics | · Apr 3, 2024 | At West Idaho Orthopedics & Sports Medicine we’re committed to providing the best possible care for residents of Treasure Valley. Our dedicated experts work tirelessly to stay abreast of the latest... |
| Norman Urology Associates | · Apr 3, 2024 | The physicians and staff at Norman Urology Associates are dedicated to serving the urological needs of Norman and the surrounding communities. We provide state of the art diagnosis and treatment and... |
| Leicester City Council | · Apr 1, 2024 | We have downloaded about 3TB of private information. |
In the newsAll →
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .