Search Ransomware Intelligence
Jump to a group, country, industry or search victims.
INC Ransom
As of Oct 19, 2026, INC Ransom has listed 997 confirmed victims on its leak site since Jan 12, 2023, 3.1% of all victims tracked by Brandefense. Its most targeted country is United States (57.7% of its victims) and its most targeted sector is Consulting.
INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europe, having posted over 200 victims in 2025 alone with no sector off-limits.
Follow and IOC feeds are part of the Brandefense platform.
- Confirmed Victims
- 997
- Rank By Victims
- #6
- Last Leak-Site Post
- Oct 16, 2026
- Top Country
- United States
- Top Sector
- Consulting
Victims Posted Per Month.
| Month | Confirmed victims |
|---|---|
| May 2026 | 31 |
| June 2026 | 33 |
| July 2026 | 38 |
| August 2026 | 44 |
| September 2026 | 34 |
| October 2026 (month in progress) | 23 |
| Month | Confirmed victims |
|---|---|
| November 2025 | 53 |
| December 2025 | 37 |
| January 2026 | 49 |
| February 2026 | 38 |
| March 2026 | 52 |
| April 2026 | 40 |
| May 2026 | 31 |
| June 2026 | 33 |
| July 2026 | 38 |
| August 2026 | 44 |
| September 2026 | 34 |
| October 2026 (month in progress) | 23 |
| Month | Confirmed victims |
|---|---|
| January 2023 | 1 |
| February 2023 | 1 |
| March 2023 | 0 |
| April 2023 | 0 |
| May 2023 | 0 |
| June 2023 | 1 |
| July 2023 | 0 |
| August 2023 | 2 |
| September 2023 | 5 |
| October 2023 | 9 |
| November 2023 | 21 |
| December 2023 | 14 |
| January 2024 | 13 |
| February 2024 | 5 |
| March 2024 | 17 |
| April 2024 | 31 |
| May 2024 | 38 |
| June 2024 | 21 |
| July 2024 | 12 |
| August 2024 | 8 |
| September 2024 | 9 |
| October 2024 | 7 |
| November 2024 | 25 |
| December 2024 | 8 |
| January 2025 | 27 |
| February 2025 | 10 |
| March 2025 | 27 |
| April 2025 | 16 |
| May 2025 | 16 |
| June 2025 | 26 |
| July 2025 | 59 |
| August 2025 | 26 |
| September 2025 | 37 |
| October 2025 | 33 |
| November 2025 | 53 |
| December 2025 | 37 |
| January 2026 | 49 |
| February 2026 | 38 |
| March 2026 | 52 |
| April 2026 | 40 |
| May 2026 | 31 |
| June 2026 | 33 |
| July 2026 | 38 |
| August 2026 | 44 |
| September 2026 | 34 |
| October 2026 (month in progress) | 23 |
Latest INC Ransom Victims.
Search all 997 →| Victim | Country | Industry | Data claimed | Posted |
|---|---|---|---|---|
| verveba.com \ verveba.com | USUnited States | Telecommunications | Not stated | |
| fairfeelegalservices.com fairfeelegalservices.com | USUnited States | Consulting | Not stated | |
| nowaszkola.com nowaszkola.com | PLPoland | Education and Research | Not stated | |
| coopecaja.fi.cr coopecaja.fi.cr | CRCosta Rica | Financial Services | Not stated | |
| FINANCIAMENTO LTDA lexcursos.com.br | BRBrazil | Manufacturing | Not stated | |
| Wolf & Sofsky GmbH wolfusofsky.de | DEGermany | Construction | Not stated |
How They Operate.
INC Ransom's threat actor profile lists 69 ATT&CK techniques, 36 exploited CVEs, 66 malware and tools, with its targets and related actors.
TTPs, CVEs and malware →Who INC Ransom Targets.
Sectors
History.
First confirmed victim listed on its leak site
First seen in Brandefense data
Busiest month on record: 59 confirmed victims
Most recent leak-site post
Get Real-Time Alerts, IOC Feeds And Takedowns.
The Brandefense platform watches every leak site for your company, vendors and executives, and acts on what it finds.