inc ransom
ransomware group · aka Inc Ransom, IncRansom · unknown (no authoritative public attribution; no confirmed country of operation) · active since 2023-07
Inc Ransom is a ransomware and data-extortion group first observed in July 2023, known for double extortion using a Tor-hosted leak site. Vendor research links its initial access to exploitation of internet-facing Citrix NetScaler appliances (CVE-2023-3519, CVE-2023-4966). It drew broad attention in March 2024 for the NHS Dumfries and Galloway breach in Scotland and in 2024 for a claimed theft of data from Citrix. Researchers have documented Windows and Linux/ESXi encryptor variants for the group's tooling. Its organizational structure (single crew versus affiliates) and aggregate earnings are not publicly established, and it remains active with intermittent victim postings.
- Initial access via exploitation of unpatched internet-facing Citrix NetScaler ADC/GateWay appliances (CVE-2023-3519; CVE-2023-4966), per vendor reporting
- Data exfiltration before encryption, followed by double extortion on a Tor leak site
- Separate encryptor builds for Windows and for Linux/ESXi environments documented by researchers
- Ransom notes dropped on compromised systems; negotiation via leak-site chat, email, or Tox
- Targets organizations holding sensitive records; healthcare and public-sector victims emphasized in public coverage
- Emphasis on large data volumes in extortion messaging, including claimed terabyte-scale thefts in 2024 reporting
- Organizational model unclear; affiliate involvement not confirmed, so per-incident attribution should be treated cautiously
NHS Dumfries and Galloway (Scotland) — March 2024, widely reported; group published stolen data, Citrix — June 2024 claimed breach; the group alleged roughly 1 TB of stolen data, per BleepingComputer (2024), Yamaha Motor Philippines subsidiary — 2023 listing reported in security press, Mediengruppe Thiel (mediengruppethiel.de) — listed on the group leak site, September 2026, per this dashboard, Wellness Partners network — listed on the group leak site, September 2026, per this dashboard
No public figure.
Leak-site victims922 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| Lincoln Property LLC | · Apr 1, 2026 | — |
| delapazlaw.com | · Mar 31, 2026 | — |
| submissionfinance.com | · Mar 31, 2026 | — |
| domingogarcia.com | · Mar 31, 2026 | — |
| millersteelelaw.com | · Mar 30, 2026 | — |
| barrypgoldberg.com | · Mar 30, 2026 | — |
| Conveyors, Inc. | · Mar 30, 2026 | — |
| Greenology Products | · Mar 29, 2026 | — |
| meridenct.gov | · Mar 27, 2026 | — |
| www.davidhelfandlaw.com | · Mar 26, 2026 | — |
| ETFSA | · Mar 26, 2026 | — |
| pulpdent.com | · Mar 25, 2026 | — |
| glenmarkpharma.com | · Mar 25, 2026 | — |
| PWNA Plains | · Mar 24, 2026 | — |
| jenningsk12.org | · Mar 24, 2026 | — |
| cerboniservices.com | · Mar 24, 2026 | — |
| Kiswire | · Mar 23, 2026 | — |
| JDV Products | · Mar 23, 2026 | — |
| airports.com.na | · Mar 19, 2026 | — |
| mcquaidinjurylaw.com | · Mar 16, 2026 | — |
| frazercenter.org | · Mar 16, 2026 | — |
| www.integer.net | · Mar 13, 2026 | — |
| thethibeauxfirm.com | · Mar 11, 2026 | — |
| Kentucky Injury | · Mar 11, 2026 | — |
| csi-ri.com | · Mar 10, 2026 | — |
| LHT Holdings Limited | · Mar 10, 2026 | — |
| Teknopres_TR | · Mar 10, 2026 | — |
| Estra Automotive | · Mar 10, 2026 | — |
| altaortho.com | · Mar 9, 2026 | — |
| tupeloeye.com | · Mar 9, 2026 | — |
| arbd.com | · Mar 9, 2026 | — |
| pacepacific.com | · Mar 9, 2026 | — |
| piglerautomation.com | · Mar 7, 2026 | — |
| northstaria.com | · Mar 5, 2026 | — |
| parkerlipman.com | · Mar 5, 2026 | — |
| saturnmachine.net | · Mar 4, 2026 | — |
| brockmaninjurylawyer.com | · Mar 4, 2026 | — |
| napolinlaw.com | · Mar 4, 2026 | — |
| bclawoffices.com | · Mar 4, 2026 | — |
| lawofficesoferichershler.com | · Mar 4, 2026 | — |
| hopkins-law.com | · Mar 4, 2026 | — |
| The City of Hesperia, CA | · Mar 4, 2026 | — |
| cwpa.com | · Mar 4, 2026 | — |
| Brockman Injury Lawyer | · Mar 4, 2026 | — |
| Hersher Law | · Mar 4, 2026 | — |
| Hopkins Law | · Mar 4, 2026 | — |
| Napolin Law Firm | · Mar 4, 2026 | — |
| Law Offices of Mark E. Lewis & Associates | · Mar 4, 2026 | — |
| www.chrishudsonlaw.com | · Mar 3, 2026 | — |
| maisonlaw.com | · Mar 3, 2026 | — |
In the newsAll →
No articles mention this group yet.