inc ransom
ransomware group · aka Inc Ransom, IncRansom · unknown (no authoritative public attribution; no confirmed country of operation) · active since 2023-07
Inc Ransom is a ransomware and data-extortion group first observed in July 2023, known for double extortion using a Tor-hosted leak site. Vendor research links its initial access to exploitation of internet-facing Citrix NetScaler appliances (CVE-2023-3519, CVE-2023-4966). It drew broad attention in March 2024 for the NHS Dumfries and Galloway breach in Scotland and in 2024 for a claimed theft of data from Citrix. Researchers have documented Windows and Linux/ESXi encryptor variants for the group's tooling. Its organizational structure (single crew versus affiliates) and aggregate earnings are not publicly established, and it remains active with intermittent victim postings.
- Initial access via exploitation of unpatched internet-facing Citrix NetScaler ADC/GateWay appliances (CVE-2023-3519; CVE-2023-4966), per vendor reporting
- Data exfiltration before encryption, followed by double extortion on a Tor leak site
- Separate encryptor builds for Windows and for Linux/ESXi environments documented by researchers
- Ransom notes dropped on compromised systems; negotiation via leak-site chat, email, or Tox
- Targets organizations holding sensitive records; healthcare and public-sector victims emphasized in public coverage
- Emphasis on large data volumes in extortion messaging, including claimed terabyte-scale thefts in 2024 reporting
- Organizational model unclear; affiliate involvement not confirmed, so per-incident attribution should be treated cautiously
NHS Dumfries and Galloway (Scotland) — March 2024, widely reported; group published stolen data, Citrix — June 2024 claimed breach; the group alleged roughly 1 TB of stolen data, per BleepingComputer (2024), Yamaha Motor Philippines subsidiary — 2023 listing reported in security press, Mediengruppe Thiel (mediengruppethiel.de) — listed on the group leak site, September 2026, per this dashboard, Wellness Partners network — listed on the group leak site, September 2026, per this dashboard
No public figure.
Leak-site victims922 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| DIEHL & CELLA ADVOGADOS ASSOCIADOS | · Jan 30, 2026 | — |
| distinctive-systems.com | · Jan 29, 2026 | — |
| LGBTQ Center Orange county | · Jan 28, 2026 | — |
| DeRenzis & Associates | · Jan 28, 2026 | — |
| anagnosdoor.com | · Jan 28, 2026 | — |
| nbccministries.org | · Jan 28, 2026 | — |
| Callagy Law Firm | · Jan 28, 2026 | — |
| ttmet.co.th | · Jan 28, 2026 | — |
| shawhillprimaryschool.org.uk | · Jan 27, 2026 | — |
| newkirklaw.com | · Jan 27, 2026 | — |
| The Trevino Group, Inc | · Jan 27, 2026 | — |
| Uniflex Technology Inc | · Jan 26, 2026 | — |
| www.shrimphouse.com | · Jan 26, 2026 | — |
| goldair.gr | · Jan 23, 2026 | — |
| tob-bmw.sk | · Jan 23, 2026 | — |
| OAB | · Jan 23, 2026 | — |
| minorsgardencenter.com | · Jan 23, 2026 | — |
| Elmore Goldsmith Kelley & deHoll | · Jan 22, 2026 | — |
| Sandberg | · Jan 20, 2026 | — |
| MKC Customs Brokers International Inc. | · Jan 18, 2026 | — |
| Southern Alberta Community Living Association | · Jan 18, 2026 | — |
| ecsc.org | · Jan 16, 2026 | — |
| cirrusaviation | · Jan 16, 2026 | — |
| https://trustarholdingsllc.com/ https://vistlabs.com/ | · Jan 15, 2026 | — |
| https://acswinc.com/ | · Jan 14, 2026 | — |
| Ju Teng International Holdings Ltd | · Jan 13, 2026 | — |
| https://bellowsmfg.com/company/ | · Jan 13, 2026 | — |
| gbmme.com | · Jan 13, 2026 | — |
| stimgroup | · Jan 13, 2026 | — |
| Rodney's Sign Company | · Jan 13, 2026 | — |
| CompactInd | · Jan 13, 2026 | — |
| Fit-Line Global | · Jan 13, 2026 | — |
| Cape Fear Country Club | · Jan 13, 2026 | — |
| Harrison Design | · Jan 12, 2026 | — |
| stignatiusijamsville.org | · Jan 12, 2026 | — |
| Rod Danielson | · Jan 12, 2026 | — |
| The Carlson Law Firm | · Jan 12, 2026 | — |
| Foshee Architecture | · Jan 12, 2026 | — |
| https://lpollockpr.com/ | · Jan 8, 2026 | — |
| Borough of Moonachie | · Jan 3, 2026 | — |
| proton-system_Serbia | · Jan 3, 2026 | — |
| Automation One Business Systems Inc | · Jan 3, 2026 | — |
| Burnham Brown | · Dec 31, 2025 | — |
| 3GH Informatica Integral | · Dec 31, 2025 | — |
| OSI Systems, Inc. | · Dec 31, 2025 | — |
| selp | · Dec 29, 2025 | — |
| omrania | · Dec 29, 2025 | — |
| klingele | · Dec 28, 2025 | — |
| WSI | · Dec 24, 2025 | — |
| svlawus.com | · Dec 21, 2025 | — |
In the newsAll →
No articles mention this group yet.