Ransomware group
Incransom ransomware: victims and leak site activity
The Incransom ransomware group has listed 968 victims on its leak site since August 2023; its latest post is from 7 October 2026. Most affected countries: United States, Canada and Germany. Most targeted sector: Professional Services.
Total posts
968
First seen
2023-08-09
Latest post
2026-10-07
Countries hit
73
About Incransom
INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europe, having posted over 200 victims in 2025 alone with no sector off-limits.
- Also known as
- Inc Ransom
- Leak site (Tor)
- http://incbacg6bfwtrlzwdbqc55gsfl763s3twdtwhp27dzuik6s6rwdcityd.onion/api/v1/blog/get/announcements?page=1&perPage=15
- Profile
- ransomware.live
Most targeted countries
- United States 538
- Canada 50
- Germany 42
- United Kingdom 39
- Australia 26
- Brazil 15
- France 12
- Italy 12
- Spain 11
- Austria 10
Most targeted sectors
- Professional Services 198
- Healthcare 142
- Manufacturing 140
- Technology 112
- Education 76
- Government & Defense 56
- Retail & E-Commerce 52
- Financial Services 45
- Transportation 33
- Agriculture and Food Production 28