inc ransom
ransomware group · aka Inc Ransom, IncRansom · unknown (no authoritative public attribution; no confirmed country of operation) · active since 2023-07
Inc Ransom is a ransomware and data-extortion group first observed in July 2023, known for double extortion using a Tor-hosted leak site. Vendor research links its initial access to exploitation of internet-facing Citrix NetScaler appliances (CVE-2023-3519, CVE-2023-4966). It drew broad attention in March 2024 for the NHS Dumfries and Galloway breach in Scotland and in 2024 for a claimed theft of data from Citrix. Researchers have documented Windows and Linux/ESXi encryptor variants for the group's tooling. Its organizational structure (single crew versus affiliates) and aggregate earnings are not publicly established, and it remains active with intermittent victim postings.
- Initial access via exploitation of unpatched internet-facing Citrix NetScaler ADC/GateWay appliances (CVE-2023-3519; CVE-2023-4966), per vendor reporting
- Data exfiltration before encryption, followed by double extortion on a Tor leak site
- Separate encryptor builds for Windows and for Linux/ESXi environments documented by researchers
- Ransom notes dropped on compromised systems; negotiation via leak-site chat, email, or Tox
- Targets organizations holding sensitive records; healthcare and public-sector victims emphasized in public coverage
- Emphasis on large data volumes in extortion messaging, including claimed terabyte-scale thefts in 2024 reporting
- Organizational model unclear; affiliate involvement not confirmed, so per-incident attribution should be treated cautiously
NHS Dumfries and Galloway (Scotland) — March 2024, widely reported; group published stolen data, Citrix — June 2024 claimed breach; the group alleged roughly 1 TB of stolen data, per BleepingComputer (2024), Yamaha Motor Philippines subsidiary — 2023 listing reported in security press, Mediengruppe Thiel (mediengruppethiel.de) — listed on the group leak site, September 2026, per this dashboard, Wellness Partners network — listed on the group leak site, September 2026, per this dashboard
No public figure.
Leak-site victims922 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| mcfirm.com | · Mar 2, 2026 | — |
| https://www.precisioncoating.com/ | · Mar 2, 2026 | — |
| Martin, Cukjati & Tom, LLP | · Mar 2, 2026 | — |
| http://ramet-trom.co.il/ | · Mar 1, 2026 | — |
| denmark.k12.wi.us | · Mar 1, 2026 | — |
| abramssales.com | · Mar 1, 2026 | — |
| lke-group.com | · Mar 1, 2026 | — |
| Lymphedema Therapy Specialists | · Feb 27, 2026 | — |
| Law Offices Taenzer & Ettenson, P.C. (tesalaw.com) | · Feb 27, 2026 | — |
| Empresa de Transportes Via Pajuçara Ltda. | · Feb 27, 2026 | — |
| Tract Consulting | · Feb 27, 2026 | — |
| https://daricon.com/ (military US/CA/NATO) | · Feb 26, 2026 | — |
| https://daricon.com/ | · Feb 26, 2026 | — |
| WE Fitness | · Feb 26, 2026 | — |
| APRO Asian Protection Pte Ltd | · Feb 26, 2026 | — |
| JA AKITA KITA LIFE SERVICE, K.K | · Feb 26, 2026 | — |
| acwapower.com \ https://www.larsentoubro.com/ | · Feb 24, 2026 | — |
| primepak.com | · Feb 23, 2026 | — |
| The City of Cocoa | · Feb 23, 2026 | — |
| Rainier Clinical Research Center | · Feb 23, 2026 | — |
| polymedicure.com | · Feb 20, 2026 | — |
| aircotedivoire.com | · Feb 19, 2026 | — |
| Valgo SA | · Feb 19, 2026 | — |
| Hiwassee Builder Supply | · Feb 17, 2026 | — |
| farbank.com (flywatertravel) | · Feb 17, 2026 | — |
| ACS Accountancy | · Feb 16, 2026 | — |
| Ondine Biomedical | · Feb 16, 2026 | — |
| Nang Kuang Pharmaceutical Co., Ltd. | · Feb 15, 2026 | — |
| Bitgo | · Feb 14, 2026 | — |
| rswater.ae | · Feb 12, 2026 | — |
| Midwestern Oil & Gas | · Feb 12, 2026 | — |
| lohmann-tapes.com | · Feb 12, 2026 | — |
| auxhomeservices.com | · Feb 12, 2026 | — |
| atchadwick.net | · Feb 12, 2026 | — |
| excavationtourigny.ca | · Feb 12, 2026 | — |
| www.hfplanners.com | · Feb 11, 2026 | — |
| moultriesheriff.com | · Feb 10, 2026 | — |
| Core Supply | · Feb 10, 2026 | — |
| tuftco | · Feb 9, 2026 | — |
| AOT Japan | · Feb 5, 2026 | — |
| Western New York Energy | · Feb 3, 2026 | — |
| Blystone & Bailey | · Feb 3, 2026 | — |
| H-Behbehani Brothers WLL | · Feb 3, 2026 | — |
| ChokChey Finance | · Feb 2, 2026 | — |
| www.pucobre.cl | · Feb 2, 2026 | — |
| Best Attorneys | · Feb 2, 2026 | — |
| Foamtec International | · Feb 1, 2026 | — |
| Hawk Law Group | · Feb 1, 2026 | — |
| Beacon Mutual Insurance | · Jan 31, 2026 | — |
| PK PINHÃO & KOIFFMAN ATTORNEYS AT LAW | · Jan 30, 2026 | — |
In the newsAll →
No articles mention this group yet.