inc ransom
ransomware group · aka Inc Ransom, IncRansom · unknown (no authoritative public attribution; no confirmed country of operation) · active since 2023-07
Inc Ransom is a ransomware and data-extortion group first observed in July 2023, known for double extortion using a Tor-hosted leak site. Vendor research links its initial access to exploitation of internet-facing Citrix NetScaler appliances (CVE-2023-3519, CVE-2023-4966). It drew broad attention in March 2024 for the NHS Dumfries and Galloway breach in Scotland and in 2024 for a claimed theft of data from Citrix. Researchers have documented Windows and Linux/ESXi encryptor variants for the group's tooling. Its organizational structure (single crew versus affiliates) and aggregate earnings are not publicly established, and it remains active with intermittent victim postings.
- Initial access via exploitation of unpatched internet-facing Citrix NetScaler ADC/GateWay appliances (CVE-2023-3519; CVE-2023-4966), per vendor reporting
- Data exfiltration before encryption, followed by double extortion on a Tor leak site
- Separate encryptor builds for Windows and for Linux/ESXi environments documented by researchers
- Ransom notes dropped on compromised systems; negotiation via leak-site chat, email, or Tox
- Targets organizations holding sensitive records; healthcare and public-sector victims emphasized in public coverage
- Emphasis on large data volumes in extortion messaging, including claimed terabyte-scale thefts in 2024 reporting
- Organizational model unclear; affiliate involvement not confirmed, so per-incident attribution should be treated cautiously
NHS Dumfries and Galloway (Scotland) — March 2024, widely reported; group published stolen data, Citrix — June 2024 claimed breach; the group alleged roughly 1 TB of stolen data, per BleepingComputer (2024), Yamaha Motor Philippines subsidiary — 2023 listing reported in security press, Mediengruppe Thiel (mediengruppethiel.de) — listed on the group leak site, September 2026, per this dashboard, Wellness Partners network — listed on the group leak site, September 2026, per this dashboard
No public figure.
Leak-site victims922 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| earthsystems.com.au earthsystemseurope.com | · May 8, 2026 | — |
| egnyte.com | · May 8, 2026 | — |
| autorisk.org | · May 7, 2026 | — |
| cmswpc.com | · May 7, 2026 | — |
| lafj.org | · May 7, 2026 | — |
| Aerodiagnostics | · May 6, 2026 | — |
| EXPEDITOR | · May 5, 2026 | — |
| sanver.com.mx | · May 5, 2026 | — |
| childplace.org | · May 5, 2026 | — |
| https://www.wilkemgroup.com/ | · May 4, 2026 | — |
| northshoreenv.com | · May 2, 2026 | — |
| Arban & Carosi | · Apr 30, 2026 | — |
| Iowa Spring Manufacturing & Sales | · Apr 30, 2026 | — |
| https://www.fulcrumre.com/ | · Apr 29, 2026 | — |
| nbd3pl.com | · Apr 29, 2026 | — |
| www.durable-tech.com | · Apr 28, 2026 | — |
| sumacinc.com | · Apr 28, 2026 | — |
| Selex - Gruppo Commerciale | · Apr 27, 2026 | — |
| ldisolutions.com | · Apr 27, 2026 | — |
| BELFOR | · Apr 27, 2026 | — |
| reddycardiology.com | · Apr 27, 2026 | — |
| MTCI | · Apr 26, 2026 | — |
| krauseundco | · Apr 25, 2026 | — |
| tlctrialteam.com | · Apr 24, 2026 | — |
| Dorotea Sweden | · Apr 24, 2026 | — |
| trugreen.com | · Apr 23, 2026 | — |
| teamster773.org | · Apr 23, 2026 | — |
| krwlawyers.com | · Apr 22, 2026 | — |
| rheem | · Apr 20, 2026 | — |
| Mag. Fünder Hausverwaltungs GmbH | · Apr 17, 2026 | — |
| alupco.com | · Apr 17, 2026 | — |
| bgcsnv.org | · Apr 17, 2026 | — |
| treelawoffice.com | · Apr 17, 2026 | — |
| bdac.com.au | · Apr 13, 2026 | — |
| Straten & Kollegen | · Apr 12, 2026 | — |
| mastercom.com.au | · Apr 12, 2026 | — |
| morgancountyga.gov | · Apr 12, 2026 | — |
| www.campbell.edu | · Apr 11, 2026 | — |
| wright-ryan.com | · Apr 10, 2026 | — |
| martek co ltd. | · Apr 10, 2026 | — |
| Kannarr Eye Care | · Apr 10, 2026 | — |
| rxm.com.au | · Apr 8, 2026 | — |
| pacificwestinjury.com | · Apr 8, 2026 | — |
| Community Connections | · Apr 4, 2026 | — |
| coronapa.com | · Apr 4, 2026 | — |
| BERGE-BAU GmbH & Co. KG | · Apr 3, 2026 | — |
| Infonet Media d.o.o. | · Apr 3, 2026 | — |
| roodtrucking.com | · Apr 3, 2026 | — |
| VLawyers | · Apr 2, 2026 | — |
| irpea.it | · Apr 2, 2026 | — |
In the newsAll →
No articles mention this group yet.