Ransomware group
Incransom ransomware: victims and leak site activity
The Incransom ransomware group has listed 936 victims on its leak site since August 2023; its latest post is from 10 September 2026. Most affected countries: United States, Canada and Germany. Most targeted sector: Professional Services.
Total posts
936
First seen
2023-08-09
Latest post
2026-09-10
Countries hit
72
About Incransom
INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europe, having posted over 200 victims in 2025 alone with no sector off-limits.
- Also known as
- Inc Ransom
- Leak site (Tor)
- http://incbacg6bfwtrlzwdbqc55gsfl763s3twdtwhp27dzuik6s6rwdcityd.onion/api/v1/blog/get/announcements?page=1&perPage=15
Most targeted countries
- United States 519
- Canada 50
- Germany 41
- United Kingdom 38
- Australia 26
- Brazil 13
- France 12
- Italy 12
- Austria 10
- Spain 10
Most targeted sectors
- Professional Services 195
- Healthcare 138
- Manufacturing 135
- Technology 110
- Education 74
- Government & Defense 54
- Retail & E-Commerce 50
- Financial Services 44
- Transportation 32
- Agriculture and Food Production 28