inc ransom
ransomware group · aka Inc Ransom, IncRansom · unknown (no authoritative public attribution; no confirmed country of operation) · active since 2023-07
Victims · 7d
8▲4 vs prev. week
Victims · 30d
36active targets
Victims · 90d
112
All-time (tracked)
925since 2023-08-09
Last post
09-17 17:39UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
Inc Ransom is a ransomware and data-extortion group first observed in July 2023, known for double extortion using a Tor-hosted leak site. Vendor research links its initial access to exploitation of internet-facing Citrix NetScaler appliances (CVE-2023-3519, CVE-2023-4966). It drew broad attention in March 2024 for the NHS Dumfries and Galloway breach in Scotland and in 2024 for a claimed theft of data from Citrix. Researchers have documented Windows and Linux/ESXi encryptor variants for the group's tooling. Its organizational structure (single crew versus affiliates) and aggregate earnings are not publicly established, and it remains active with intermittent victim postings.
Tactics & tooling
- Initial access via exploitation of unpatched internet-facing Citrix NetScaler ADC/GateWay appliances (CVE-2023-3519; CVE-2023-4966), per vendor reporting
- Data exfiltration before encryption, followed by double extortion on a Tor leak site
- Separate encryptor builds for Windows and for Linux/ESXi environments documented by researchers
- Ransom notes dropped on compromised systems; negotiation via leak-site chat, email, or Tox
- Targets organizations holding sensitive records; healthcare and public-sector victims emphasized in public coverage
- Emphasis on large data volumes in extortion messaging, including claimed terabyte-scale thefts in 2024 reporting
- Organizational model unclear; affiliate involvement not confirmed, so per-incident attribution should be treated cautiously
Targeted sectors
HealthcareGovernment/Public SectorTechnologyManufacturing
Notable public victims
NHS Dumfries and Galloway (Scotland) — March 2024, widely reported; group published stolen data, Citrix — June 2024 claimed breach; the group alleged roughly 1 TB of stolen data, per BleepingComputer (2024), Yamaha Motor Philippines subsidiary — 2023 listing reported in security press, Mediengruppe Thiel (mediengruppethiel.de) — listed on the group leak site, September 2026, per this dashboard, Wellness Partners network — listed on the group leak site, September 2026, per this dashboard
CVEs linked to their intrusions
Estimated earnings
No public figure.
Leak-site victims925 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| Livability | · Nov 3, 2023 | Livability is the charity that’s committed to enabling people with disabilities to live the life they want to lead. We work to change what is unlivable, helping people to tackle the barriers they... |
| Universal Sewing Supply | · Oct 31, 2023 | Universal Sewing Supply was founded in 1956 in St. Louis, Missouri. Universal Sewing Supply provides industrial sewing equipment, supplies, and parts as well as air line components, valves, air hoses... |
| Global Export Marketing Co. Ltd. | · Oct 29, 2023 | GEMCO is a pioneering company that helps American international brands to reach out to the world. We are driven by quality, service, reliability, and our success over the last 31 years has been... |
| Alam Flora Sdn Bhd | · Oct 27, 2023 | Incorporated in 1995, Alam Flora Sdn Bhd (Alam Flora) is the leading environmental management companies in Malaysia that is dedicated to serving communities to manage and reduce waste with minimal... |
| Direct Mail Corporation | · Oct 25, 2023 | From humble beginnings in 1994, Direct Mail Corporation has grown to become one of Melbourne’s most respected Mail Houses, servicing Internet businesses, book publishers, event managers, marketers... |
| Greenpoint | · Oct 17, 2023 | Established in 1987, Greenpoint Technologies is one of the original licensed Business Jet Completion Centers providing turnkey interior completions for private individuals, corporations and Heads of... |
| Catholic Charities | · Oct 14, 2023 | Catholic Charities of Broome County is the lead agency in the joint initiative, called Encompass Family Health Home, which was selected back in June 2015 by the New York State Department of Health as... |
| Cleveland City Schools | · Oct 13, 2023 | Cleveland City Schools is a public school system located in Cleveland, Tennessee. We serve over 5,000 students across nine schools, including seven elementary schools, one middle school, and one high... |
| Vicon industries inc. | · Oct 12, 2023 | Vicon is a global leader in advanced security and surveillance technology to safeguard businesses, schools, municipalities, hospitals and cities across the world. We specialize in engineering... |
| Village Building Co. | · Oct 11, 2023 | We encourage a mix of integrated single title and multi‑unit housing in order to create strong, vibrant and diverse communities and to achieve socially responsible densities. Our communities are... |
| Sobieski | · Oct 11, 2023 | A Vision For the Future “35 years ago, J. F. Sobieski, Inc. was founded with a clear idea of what we would need for a successful future.” – John F. Sobieski, III, CEO Founded more than thirty-five... |
| Jacobsen Construction | · Sep 29, 2023 | We present to you - jacobsenconstruction.com We use an uncommon and empowering employee-ownership structure that creates significant long-term financial opportunities for the workforce; promotes... |
| Agilitas IT Solutions Limited | · Sep 22, 2023 | We have been contacted by representative of the Agilitas IT Services company. Through long negotiation process we have proved that source code of applications made by Agilitas IT Services and other... |
| ENTRUST Solutions Group | · Sep 20, 2023 | ENTRUST Solutions Group is a community of people, 3,100+ strong, who are committed to our clients and each other. We are diverse, talented, dedicated, and wholly focused on not only meeting the needs... |
| Federal Labor Relations Authority | · Sep 20, 2023 | The Federal Labor Relations Authority (FLRA) is an independent agency of the United States government that governs labor relations between the federal government and its employees. |
| Leoch Battery | · Sep 20, 2023 | Products Lithium Battery Lithium solutions are mainly used in network power, green energy storage and transportation with high energy density, exceptional performance, and long life. Leoch has a... |
| Elemetal | · Sep 18, 2023 | Elemetal is one of the largest precious metals refiner. They are laundering money for drug cartel and can't find a small amount to prevent data leak. Cost of their privacy is $160.000. 600GB of... |
| ************ | · Sep 18, 2023 | ************ one of the largest precious metals refiner. they are laundering money for drug cartel and can't find a small amount to prevent data leak. we will name company on Friday if there will be... |
| Abbeyfield | · Sep 12, 2023 | It's our mission to provide the best service of care and housing for all our residents, and to be a champion for older people. |
| I Keating Furniture World | · Sep 6, 2023 | I. Keating Furniture World is a family owned Furniture & Mattresses store located in Minot, ND. |
| It4 Solutions Robras | · Sep 6, 2023 | It4 Solutions Robras Corp is a company that operates in the Information Technology and Services industry. |
| Arkopharma | · Sep 3, 2023 | Arkopharma in brief Arkopharma is a pharmaceutical laboratory specialised in the area of phytotherapy, natural medicine and dietary supplements. |
| Pifer's Auction & Realty | · Aug 31, 2023 | Pifer's Auction & Realty is a full service auction and real estate firm specializing in land auctions, machinery auctions, and land management. |
| Hemmink | · Aug 16, 2023 | say hello martin! you have very bad it specialists |
| Thermenhotel Stoiser | · Aug 9, 2023 | ENJOY! |
In the newsAll →
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .