inc ransom
ransomware group · aka Inc Ransom, IncRansom · unknown (no authoritative public attribution; no confirmed country of operation) · active since 2023-07
Inc Ransom is a ransomware and data-extortion group first observed in July 2023, known for double extortion using a Tor-hosted leak site. Vendor research links its initial access to exploitation of internet-facing Citrix NetScaler appliances (CVE-2023-3519, CVE-2023-4966). It drew broad attention in March 2024 for the NHS Dumfries and Galloway breach in Scotland and in 2024 for a claimed theft of data from Citrix. Researchers have documented Windows and Linux/ESXi encryptor variants for the group's tooling. Its organizational structure (single crew versus affiliates) and aggregate earnings are not publicly established, and it remains active with intermittent victim postings.
- Initial access via exploitation of unpatched internet-facing Citrix NetScaler ADC/GateWay appliances (CVE-2023-3519; CVE-2023-4966), per vendor reporting
- Data exfiltration before encryption, followed by double extortion on a Tor leak site
- Separate encryptor builds for Windows and for Linux/ESXi environments documented by researchers
- Ransom notes dropped on compromised systems; negotiation via leak-site chat, email, or Tox
- Targets organizations holding sensitive records; healthcare and public-sector victims emphasized in public coverage
- Emphasis on large data volumes in extortion messaging, including claimed terabyte-scale thefts in 2024 reporting
- Organizational model unclear; affiliate involvement not confirmed, so per-incident attribution should be treated cautiously
NHS Dumfries and Galloway (Scotland) — March 2024, widely reported; group published stolen data, Citrix — June 2024 claimed breach; the group alleged roughly 1 TB of stolen data, per BleepingComputer (2024), Yamaha Motor Philippines subsidiary — 2023 listing reported in security press, Mediengruppe Thiel (mediengruppethiel.de) — listed on the group leak site, September 2026, per this dashboard, Wellness Partners network — listed on the group leak site, September 2026, per this dashboard
No public figure.
Leak-site victims917 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| pushidrosal.id | · Aug 4, 2026 | — |
| lccgroup.com | · Aug 4, 2026 | — |
| https://geleximco.vn/ | · Aug 4, 2026 | — |
| ecfa.org | · Aug 2, 2026 | — |
| quantinuum.com | · Aug 2, 2026 | — |
| PARTNERED HEALTH GROUP | · Jul 30, 2026 | — |
| sslf.local | · Jul 30, 2026 | — |
| harwal.net | · Jul 29, 2026 | — |
| Della Casa Group AG | · Jul 28, 2026 | — |
| https://eclmn.com/ | · Jul 28, 2026 | — |
| minigrip.com.mx | · Jul 28, 2026 | — |
| DUCON | · Jul 28, 2026 | — |
| greenecountyga.gov | · Jul 28, 2026 | — |
| foundationstofreedom.org | · Jul 28, 2026 | — |
| takethehop.com | · Jul 27, 2026 | — |
| healthlawadvocates.org | · Jul 26, 2026 | — |
| autismuslink.ch | · Jul 24, 2026 | — |
| cabincreekhealth.com | · Jul 23, 2026 | — |
| Ali-Monde | · Jul 20, 2026 | — |
| v-silicon.com | · Jul 18, 2026 | — |
| FAST.COM.PH | · Jul 18, 2026 | — |
| D.MAG New Material Technology Co., Ltd. Taiwan Giant | · Jul 18, 2026 | — |
| vedan corp | · Jul 18, 2026 | — |
| pokka.co | · Jul 18, 2026 | — |
| reatile.co.za | · Jul 18, 2026 | — |
| V&P Nurseries | · Jul 18, 2026 | — |
| Kyokuto Kaihatsu Kogyo | · Jul 17, 2026 | — |
| asa-international.com | · Jul 16, 2026 | — |
| https://www.statebankofnauvoo.com/ | · Jul 16, 2026 | — |
| VantagePoint Management & Autoclear | · Jul 14, 2026 | — |
| Golden Glasko & Associates | · Jul 14, 2026 | — |
| Aesthetic Surgical Images | · Jul 7, 2026 | — |
| tecnocurva.com.br | · Jul 7, 2026 | — |
| samberger24.de | · Jul 7, 2026 | — |
| oakparkmi.gov | · Jul 3, 2026 | — |
| tambasa.com | · Jul 2, 2026 | — |
| tricountyhs.org | · Jul 2, 2026 | — |
| acworth-ga.gov | · Jul 2, 2026 | — |
| carvalima.com.br | · Jul 2, 2026 | — |
| ezortea.com.br | · Jul 2, 2026 | — |
| hamilton-eye.com | · Jul 2, 2026 | — |
| Colorado Rehabilitation and Occupational Medicine | · Jul 2, 2026 | — |
| https://www.roundshield.com/ | · Jul 2, 2026 | — |
| https://sza.it/ | · Jun 30, 2026 | — |
| GDN AR(Dorinka) | · Jun 29, 2026 | — |
| callhorton.com | · Jun 26, 2026 | — |
| johndufourlaw.com | · Jun 26, 2026 | — |
| theswansonlawgroup.com | · Jun 26, 2026 | — |
| Life Bridges | · Jun 26, 2026 | — |
| GSP Crop Science Pvt | · Jun 26, 2026 | — |
In the newsAll →
No articles mention this group yet.