INC Ransom
Data as of August 16, 2026.
Credential exposure before the attack
24.1% of INC Ransom victims whose domain we can identify (213 of 885) had employee credentials leak in the 12 months before INC Ransom named them as a victim.
We don't know whether any of these credentials were how INC Ransom gained initial access.
What industries INC Ransom targets
Sector identified for 607 of 885 victims.
| Manufacturing | 116 | |
| Healthcare | 109 | |
| Legal | 72 | |
| Education | 57 | |
| Construction | 50 | |
| Financial Services | 45 | |
| Non-profit | 29 | |
| Government | 25 |
Where the victims are located
Country identified for 583 of 885 victims.
| United States | 275 | |
| Canada | 43 | |
| Germany | 38 | |
| United Kingdom | 31 | |
| Australia | 23 | |
| New Zealand | 19 | |
| France | 11 | |
| Brazil | 11 |
Most recent INC Ransom victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Cambria Law Firm cambrialawfirm.com | Legal | Canada | Aug 14, 2026 |
| Compunnel compunnel.com | Technology | United States | Aug 14, 2026 |
| Brighton East Dental Clinic bedc.com.au | Healthcare | Australia | Aug 13, 2026 |
| Diabetes and Metabolism Specialists diabetesandmetabolism.com | Healthcare | United States | Aug 13, 2026 |
| Greater Austin Merchants Cooperative Association gamaus.com | Not identified | United States | Aug 13, 2026 |
| Stuart & Associates Commercial Flooring stuartandassociates.com | Not identified | United States | Aug 13, 2026 |
| ATMS & Co. atmsco.in | Financial Services | India | Aug 10, 2026 |
| Louisville Bar Association loubar.org | Education | United States | Aug 10, 2026 |
| Lantis Enterprises lantisnet.com | Healthcare | United States | Aug 6, 2026 |
| Virginia Peninsula Regional Jail vprj.org | Government | United States | Aug 6, 2026 |
| Clinton Health Access Initiative clintonhealthaccess.org | Healthcare | United States | Aug 5, 2026 |
| Geleximco Group geleximco.vn | Real Estate | Canada | Aug 5, 2026 |
| Liberty Commercial Center lcc.com.ph | Not identified | United States | Aug 5, 2026 |
| Loyalist College loyalistcollege.com | Financial Services | Canada | Aug 5, 2026 |
| Pusand Hidro-Oseanografi TNI Angkatan Laut pushidrosal.id | Not identified | Indonesia | Aug 5, 2026 |
| Trulite Glass & Aluminum Solutions trulite.com | Financial Services | Canada | Aug 5, 2026 |
| Oleoductos del Valle oldelval.com | Logistics | Argentina | Aug 4, 2026 |
| ECFA ecfa.org | Non-profit | United States | Aug 3, 2026 |
| Quantinuum quantinuum.com | Technology | United States | Aug 3, 2026 |
| Partnered Health partneredhealth.com.au | Healthcare | Australia | Jul 31, 2026 |
Showing the 20 most recent of 885. Browse recent data breaches for more.
INC Ransom leak sites
Addresses we've seen INC Ransom publish victims from. Any .onion address needs the Tor Browser.
incbackrlasjesgpfu5brktfjknbqoahe2hhmqfhasc5fb56mtukn4yd.onionincblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad.onionincblog7vmuq7rktic73r4ha4j757m3ptym37tyvifzp2roedyyzzxid.onion7cau5ch6xfngbiqvy7df3qgfmzpoe6ogdz6q32jjpph6rrd4fdbvruad.onioninccdnxn5cr2blbrlmfehkj5rrswjaai2mqr663dsylfv6zciqilojyd.oniontotos7fquprkecvcsl2jwy72v32glgkp2ejeqlnx5ynnxvbebgnletqd.onionincapt.blognspiremkiq44zcxjbgvab4mdedyh2pzj5kzbmvftcugq3mczx3dqogid.oniontezwsse5czllksjb7cwp65rvnk4oobmzti2znn42i43bjdfd2prqqkad.onion5q3lywcjrujw3vao7cz3ruqd57ugfdcu3qiisklpqillvuidl5wiqlqd.oniontxtggyng5euqkyzl2knbejwpm4rlq575jn2egqldu27osbqytrj6ruyd.onion
INC Ransom questions
Is INC Ransom still active?
Yes. INC Ransom posted its most recent victim on August 14, 2026. That's 44 victims in the last 30 days.
How many victims has INC Ransom claimed?
INC Ransom has named 885 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 460 of them were posted in the last 12 months.
When did INC Ransom first appear?
The first victim we recorded for INC Ransom was posted on January 2, 2023. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does INC Ransom target?
Manufacturing accounts for the most victims we can classify, with 116. Healthcare follows at 109. We could identify a sector for 607 of 885 victims, so treat this as the shape of the targeting rather than a full census.
Has INC Ransom already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.