INC Ransom
Data as of September 14, 2026.
Credential exposure before the attack
23.6% of INC Ransom victims whose domain we can identify (218 of 923) had employee credentials leak in the 12 months before INC Ransom named them as a victim.
We don't know whether any of these credentials were how INC Ransom gained initial access.
What industries INC Ransom targets
Sector identified for 636 of 923 victims.
| Manufacturing | 123 | |
| Healthcare | 114 | |
| Legal | 75 | |
| Education | 58 | |
| Construction | 56 | |
| Financial Services | 49 | |
| Non-profit | 29 | |
| Government | 26 |
Where the victims are located
Country identified for 619 of 923 victims.
| United States | 291 | |
| Canada | 46 | |
| Germany | 41 | |
| United Kingdom | 32 | |
| Australia | 23 | |
| New Zealand | 19 | |
| Brazil | 11 | |
| Austria | 11 |
Most recent INC Ransom victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| JMS Building jmsbuildingcorp.com | Financial Services | United States | Sep 11, 2026 |
| Cullotta Bravo Law Group cullottalaw.com | Legal | United States | Sep 10, 2026 |
| Mediengruppe Thiel mediengruppethiel.de | Not identified | Germany | Sep 10, 2026 |
| Community Wellness Partners cwpinc.org | Healthcare | United States | Sep 8, 2026 |
| Myglobal Services myglobalssb.com | Construction | Malaysia | Sep 4, 2026 |
| Asfaltos y Pavimentos asfalpasa.es | Construction | Spain | Sep 3, 2026 |
| Macro Engineering & Technology macroeng.com | Manufacturing | Canada | Sep 3, 2026 |
| Metales Panamericanos metalpan.com | Construction | Not identified | Sep 3, 2026 |
| Multiver Ltée multiver.ca | Manufacturing | Canada | Sep 3, 2026 |
| Policlinico Triestino polifvg.it | Healthcare | Italy | Sep 3, 2026 |
| Specialty Textile Services specialtytextile.com | Hospitality | United States | Sep 3, 2026 |
| Trucka trucka.com.mx | Logistics | Mexico | Sep 3, 2026 |
| Westfield Public School District westfieldnjk12.org | Education | United States | Sep 3, 2026 |
| CIMB Securities cimbsecurities.com | Financial Services | Malaysia | Sep 1, 2026 |
| FFKR Architects ffkr.com | Not identified | United States | Sep 1, 2026 |
| Lichtvision Design lichtvision.com | Not identified | Germany | Sep 1, 2026 |
| New Century Ophthalmology ncophth.com | Healthcare | United States | Sep 1, 2026 |
| RENO Refractories renorefractories.com | Manufacturing | United States | Sep 1, 2026 |
| Zummo zummocorp.com | Manufacturing | Spain | Sep 1, 2026 |
| Oilquip oilquip.com | Not identified | United States | Aug 31, 2026 |
Showing the 20 most recent of 923. Browse recent data breaches for more.
INC Ransom leak sites
Addresses we've seen INC Ransom publish victims from. Any .onion address needs the Tor Browser.
incbackrlasjesgpfu5brktfjknbqoahe2hhmqfhasc5fb56mtukn4yd.onionincblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad.onionincblog7vmuq7rktic73r4ha4j757m3ptym37tyvifzp2roedyyzzxid.onion7cau5ch6xfngbiqvy7df3qgfmzpoe6ogdz6q32jjpph6rrd4fdbvruad.onioninccdnxn5cr2blbrlmfehkj5rrswjaai2mqr663dsylfv6zciqilojyd.oniontotos7fquprkecvcsl2jwy72v32glgkp2ejeqlnx5ynnxvbebgnletqd.onionincapt.blognspiremkiq44zcxjbgvab4mdedyh2pzj5kzbmvftcugq3mczx3dqogid.oniontxtggyng5euqkyzl2knbejwpm4rlq575jn2egqldu27osbqytrj6ruyd.onion5q3lywcjrujw3vao7cz3ruqd57ugfdcu3qiisklpqillvuidl5wiqlqd.oniontezwsse5czllksjb7cwp65rvnk4oobmzti2znn42i43bjdfd2prqqkad.onion
INC Ransom questions
Is INC Ransom still active?
Yes. INC Ransom posted its most recent victim on September 11, 2026. That's 38 victims in the last 30 days.
How many victims has INC Ransom claimed?
INC Ransom has named 923 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 466 of them were posted in the last 12 months.
When did INC Ransom first appear?
The first victim we recorded for INC Ransom was posted on January 2, 2023. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does INC Ransom target?
Manufacturing accounts for the most victims we can classify, with 123. Healthcare follows at 114. We could identify a sector for 636 of 923 victims, so treat this as the shape of the targeting rather than a full census.
Has INC Ransom already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.