INC Ransom
Data as of October 1, 2026.
Credential exposure before the attack
23.6% of INC Ransom victims whose domain we can identify (223 of 945) had employee credentials leak in the 12 months before INC Ransom named them as a victim.
We don't know whether any of these credentials were how INC Ransom gained initial access.
What industries INC Ransom targets
Sector identified for 652 of 945 victims.
| Manufacturing | 124 | |
| Healthcare | 118 | |
| Legal | 77 | |
| Education | 59 | |
| Construction | 56 | |
| Financial Services | 49 | |
| Non-profit | 31 | |
| Government | 28 |
Where the victims are located
Country identified for 638 of 945 victims.
| United States | 299 | |
| Canada | 46 | |
| Germany | 41 | |
| United Kingdom | 33 | |
| Australia | 23 | |
| New Zealand | 19 | |
| Brazil | 12 | |
| France | 11 |
Most recent INC Ransom victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| BCX bcx.co.za | Government | South Africa | Sep 30, 2026 |
| Bake My Day bakemyday.se | Not identified | Sweden | Sep 29, 2026 |
| Ahead ahead.com | Not identified | United States | Sep 28, 2026 |
| North Slope Borough School District nsbsd.org | Education | United States | Sep 28, 2026 |
| Pharma 5 pharma5.ma | Healthcare | Not identified | Sep 28, 2026 |
| BN Intellectual Property Services bn-ip.com | Legal | China | Sep 25, 2026 |
| Grupo Caberj caberj.com.br | Healthcare | Brazil | Sep 25, 2026 |
| United Kingdom Brazilian Jiu Jitsu Association ukbjja.org | Non-profit | United Kingdom | Sep 25, 2026 |
| Welgen One welgenone.com | Healthcare | United States | Sep 25, 2026 |
| Virginia A. Lemon vlemonlaw.com | Legal | United States | Sep 24, 2026 |
| Kriger Orthodontics bonitaortho.com | Healthcare | United States | Sep 22, 2026 |
| Second House secondhouse.es | Real Estate | Spain | Sep 22, 2026 |
| Kendall Hunt Publishing kendallhunt.com | Media | Not identified | Sep 21, 2026 |
| Roan Camping Holidays roancampingholidays.com | Not identified | Netherlands | Sep 21, 2026 |
| Appliance Factory & Mattress Kingdom appliancefactory.com | Manufacturing | United States | Sep 18, 2026 |
| Autoservicio Mayorista Diarco diarco.com.ar | Retail | Argentina | Sep 18, 2026 |
| Silicon Integrated Systems sis.com.tw | Not identified | Taiwan | Sep 18, 2026 |
| Aidon Oy aidon.com | Energy | Finland | Sep 17, 2026 |
| Chicago History Museum chicagohistory.org | Non-profit | United States | Sep 17, 2026 |
| Partners HoldCo partnersholdco.com | Not identified | Czech Republic | Sep 17, 2026 |
Showing the 20 most recent of 945. Browse recent data breaches for more.
INC Ransom leak sites
Addresses we've seen INC Ransom publish victims from. Any .onion address needs the Tor Browser.
incbackrlasjesgpfu5brktfjknbqoahe2hhmqfhasc5fb56mtukn4yd.onionincblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad.onionincblog7vmuq7rktic73r4ha4j757m3ptym37tyvifzp2roedyyzzxid.onion7cau5ch6xfngbiqvy7df3qgfmzpoe6ogdz6q32jjpph6rrd4fdbvruad.onioninccdnxn5cr2blbrlmfehkj5rrswjaai2mqr663dsylfv6zciqilojyd.oniontotos7fquprkecvcsl2jwy72v32glgkp2ejeqlnx5ynnxvbebgnletqd.onionincapt.blognspiremkiq44zcxjbgvab4mdedyh2pzj5kzbmvftcugq3mczx3dqogid.oniontezwsse5czllksjb7cwp65rvnk4oobmzti2znn42i43bjdfd2prqqkad.onion5q3lywcjrujw3vao7cz3ruqd57ugfdcu3qiisklpqillvuidl5wiqlqd.oniontxtggyng5euqkyzl2knbejwpm4rlq575jn2egqldu27osbqytrj6ruyd.onion
INC Ransom questions
Is INC Ransom still active?
Yes. INC Ransom posted its most recent victim on September 30, 2026. That's 41 victims in the last 30 days.
How many victims has INC Ransom claimed?
INC Ransom has named 945 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 467 of them were posted in the last 12 months.
When did INC Ransom first appear?
The first victim we recorded for INC Ransom was posted on January 2, 2023. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does INC Ransom target?
Manufacturing accounts for the most victims we can classify, with 124. Healthcare follows at 118. We could identify a sector for 652 of 945 victims, so treat this as the shape of the targeting rather than a full census.
Has INC Ransom already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.