Ransomware Group intelligence

Incransom

Active

Track Incransom with 986 published victims and 7 known leak locations in a single intelligence view.

BREACH HOUSE ALERTS

Want an alert every time a new ransomware post is published?

Choose the feeds and the countries you care about — we email you when they move.

Victims 986 Known published victims in this dataset

First discovered 2023-08-09 Earliest victim discovery date

Last discovered 2026-10-15 Latest victim discovery date

Inactive since 1 days Days since the latest known victim

Top country United States 545 victims

Known locations 7 Leak or negotiation infrastructure tracked

Incransom is tracked by Breach House as a ransomware group with 986 published victims.

United States is currently the most targeted country in this dataset.

7 known leak locations are currently associated with this group.

986

Leaked 281 28.5%
Pending 702 71.2%
Deleted 3 0.3%

Top Countries

Distribution

Label	Type	Availability	Links
Leak location 6	Onion service	Up checked 4h ago	`incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad.onion`
Leak location 7	Onion service	Up checked 4h ago	`incbacg6bfwtrlzwdbqc55gsfl763s3twdtwhp27dzuik6s6rwdcityd.onion`
Leak location 2	Onion service	Down checked 4h ago	`incbackrlasjesgpfu5brktfjknbqoahe2hhmqfhasc5fb56mtukn4yd.onion`
Leak location 5	Web location	Down checked 4h ago	`incapt.su`
Leak location 1	Onion service	Down checked 4h ago	`incblog7vmuq7rktic73r4ha4j757m3ptym37tyvifzp2roedyyzzxid.onion`
Leak location 4	Web location	Down checked 4h ago	`incapt.blog`
Leak location 3	Web location	Down checked 4h ago	`incbackend.top`

Communication / Marketing 173
Healthcare / Pharma 116
Finance / Legal / Insurance 114
Services 81
Manufacturing / Engineering 76
Education 58
Not identified 56
Construction / Real Estate 53
Public Sector 45
IT 40
Retail / E-commerce 32
Transportation / Travel / Logistics 24
NGOs / Associations 24
Energy 22
Hospitality / Food & Beverage / Tourism 17
Agriculture / Food 14
Telecommunications 11
null 2

Typical Attacks (35)

▼

How Incransom typically operates, as attributed by MITRE ATT&CK v20.0. Attributed via INC Ransom, INC Ransomware.

T1588.002 Tool Resource Development

What they do: INC Ransom has acquired and used several tools including MegaSync, AnyDesk, esentutl and PsExec.

What that means: Adversaries may buy, steal, or download software tools that can be used during targeting.
T1078 Valid Accounts Initial AccessPersistencePrivilege EscalationStealth

What they do: INC Ransom has used compromised valid accounts for access to victim environments.

What that means: Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
T1190 Exploit Public-Facing Application Initial Access

What they do: INC Ransom has exploited known vulnerabilities including CVE-2023-3519 in Citrix NetScaler for initial access.

What that means: Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1566 Phishing Initial Access

What they do: INC Ransom has used phishing to gain initial access.

What that means: Adversaries may send phishing messages to gain access to victim systems.
T1047 Windows Management Instrumentation Execution

What they do: INC Ransom has used WMIC to deploy ransomware.

What that means: Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads.
T1059.003 Windows Command Shell Execution

What they do: INC Ransom has used `cmd.exe` to launch malicious payloads.

What that means: Adversaries may abuse the Windows command shell for execution.
T1106 Native API Execution

What they do: INC Ransomware can use the API `DeviceIoControl` to resize the allocated space for and cause the deletion of volume shadow copy snapshots.

What that means: Adversaries may interact with the native OS application programming interface (API) to execute behaviors.
T1569.002 Service Execution Execution

What they do: INC Ransom has run a file encryption executable via `Service Control Manager/7045;winupd,%SystemRoot%\winupd.exe,user mode service,demand start,LocalSystem`.

What that means: Adversaries may abuse the Windows service control manager to execute malicious commands or payloads.
T1036.005 Match Legitimate Resource Name or Location Stealth

What they do: INC Ransom has named a PsExec executable winupd to mimic a legitimate Windows update file.

What that means: Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them.
T1070.004 File Deletion Stealth

What they do: INC Ransom has uninstalled tools from compromised endpoints after use.

What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
T1140 Deobfuscate/Decode Files or Information Stealth

What they do: INC Ransomware can run `CryptStringToBinaryA` to decrypt base64 content containing its ransom note.

What that means: Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis.
T1685 Disable or Modify Tools Defense Impairment

What they do: INC Ransom can use SystemSettingsAdminFlows.exe, a native Windows utility, to disable Windows Defender.

What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
T1046 Network Service Discovery Discovery

What they do: INC Ransom has used NETSCAN.EXE for internal reconnaissance.

What that means: Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation.
T1049 System Network Connections Discovery Discovery

What they do: INC Ransom has used RDP to test network connections.

What that means: Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
T1057 Process Discovery Discovery

What they do: INC Ransomware can use the Microsoft Win32 Restart Manager to kill processes with a specific handle or that are accessing resources it wants to encrypt.

What that means: Adversaries may attempt to get information about running processes on a system.
T1069.002 Domain Groups Discovery

What they do: INC Ransom has enumerated domain groups on targeted hosts.

What that means: Adversaries may attempt to find domain-level groups and permission settings.
T1083 File and Directory Discovery Discovery

What they do: INC Ransomware can receive command line arguments to encrypt specific files and directories.

What that means: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
T1087.002 Domain Account Discovery

What they do: INC Ransom has scanned for domain admin accounts in compromised environments.

What that means: Adversaries may attempt to get a listing of domain accounts.
T1120 Peripheral Device Discovery Discovery

What they do: INC Ransomware can identify external USB and hard drives for encryption and printers to print ransom notes.

What that means: Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.
T1135 Network Share Discovery Discovery

What they do: INC Ransom has used Internet Explorer to view folders on other systems.

What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
T1652 Device Driver Discovery Discovery

What they do: INC Ransomware can verify the presence of specific drivers on compromised hosts including Microsoft Print to PDF and Microsoft XPS Document Writer.

What that means: Adversaries may attempt to enumerate local device drivers on a victim host.
T1680 Local Storage Discovery Discovery

What they do: INC Ransomware can discover and mount hidden drives to encrypt them.

What that means: Adversaries may enumerate local drives, disks, and/or volumes and their attributes like total or free space and volume serial number.
T1021.001 Remote Desktop Protocol Lateral Movement

What they do: INC Ransom has used RDP to move laterally.

What that means: Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP).
T1570 Lateral Tool Transfer Lateral Movement

What they do: INC Ransom has used a rapid succession of copy commands to install a file encryption executable across multiple endpoints within compromised infrastructure.

What that means: Adversaries may transfer tools or other files between systems in a compromised environment.
T1074 Data Staged Collection

What they do: INC Ransom has staged data on compromised hosts prior to exfiltration.

What that means: Adversaries may stage collected data in a central location or directory prior to Exfiltration.
T1560.001 Archive via Utility Collection

What they do: INC Ransom has used 7-Zip and WinRAR to archive collected data prior to exfiltration.

What that means: Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration.
T1071 Application Layer Protocol Command and Control

What they do: INC Ransom has used valid accounts over RDP to connect to targeted systems.

What that means: Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic.
T1105 Ingress Tool Transfer Command and Control

What they do: INC Ransom has downloaded tools to compromised servers including Advanced IP Scanner.

What that means: Adversaries may transfer tools or other files from an external system into a compromised environment.
T1219 Remote Access Tools Command and Control

What they do: INC Ransom has used AnyDesk and PuTTY on compromised systems.

What that means: An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network.
T1537 Transfer Data to Cloud Account Exfiltration

What they do: INC Ransom has used Megasync to exfiltrate data to the cloud.

What that means: Adversaries may exfiltrate data by transferring the data, including through sharing/syncing and creating backups of cloud environments, to another cloud account they control on the same service.
T1486 Data Encrypted for Impact Impact

What they do: INC Ransom has used INC Ransomware to encrypt victim's data.

What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
T1489 Service Stop Impact

What they do: INC Ransomware can issue a command to kill a process on compromised hosts.

What that means: Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.
T1490 Inhibit System Recovery Impact

What they do: INC Ransomware can delete volume shadow copy backups from victim machines.

What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
T1491.001 Internal Defacement Impact

What they do: INC Ransomware has the ability to change the background wallpaper image to display the ransom note.

What that means: An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems.
T1657 Financial Theft Impact

What they do: INC Ransom has stolen and encrypted victim's data in order to extort payment for keeping it private or decrypting it.

What that means: Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own financial gain at the expense of the availability of these resources for victims.

Tools Observed (11)

▼

Software Incransom has been seen using, grouped by what it is used for. Legitimate administration tools appear here because these actors routinely abuse them — presence in this list is not itself malicious.

Discovery

AdFind Advanced IP Scanner

Discovery & enumeration

AdFind Advanced IP Scanner

Exfiltration

BackBlaze MEGA Restic RClone s5cmd

LOLBAS (living-off-the-land binaries)

Finger PsExec

Tool data from Ransomware Tool Matrix by BushidoUK, licensed CC BY 4.0. Grouped by purpose and matched to this group by Breach House.

Victims (986)

Search, filter and paginate the victim timeline for Incransom. Showing 901–986 of 986.

Type	Target	Discovered	Country	Business Category	Leak status
Ransomware	Henningson & Snoxell, Ltd. id11611 View details	2024-04-11	United States	Finance / Legal / Insurance	pending
Located in Maple Grove, Minnesota, Henningson & Snoxell has served businesses and individuals throughout the Minneapolis-St. Paul Metro area and beyond since 1981. Our suburban law firm combines... ID 11611
Ransomware	Remitano - Cryptocurrency Exchange id11510 View details	2024-04-04	Seychelles	Retail / E-commerce	pending
Remitano App is an Escrowed P2P Cryptocurrency Exchange. We help you easily Buy - Sell - Store - Invest - Deposit & Withdraw cryptocurrencies with Fiat Wallet FAST & SECURELY. Our app supports... ID 11510
Ransomware	West Idaho Orthopedics id11498 View details	2024-04-03	United States	Healthcare / Pharma	pending
At West Idaho Orthopedics & Sports Medicine we’re committed to providing the best possible care for residents of Treasure Valley. Our dedicated experts work tirelessly to stay abreast of the latest... ID 11498
Ransomware	Norman Urology Associates id11497 View details	2024-04-03	United States	Communication / Marketing	pending
The physicians and staff at Norman Urology Associates are dedicated to serving the urological needs of Norman and the surrounding communities. We provide state of the art diagnosis and treatment and... ID 11497
Ransomware	Leicester City Council id11493 View details	2024-04-03	United Kingdom	Public Sector	pending
We have downloaded about 3TB of private information. ID 11493
Ransomware	Xenwerx Initiatives, LLC id11465 View details	2024-04-01	United States	Communication / Marketing	pending
Xenwerx Initiatives, LLC provides a full suite of services and products to help our customer’s be successful with their virtualization initiatives. ID 11465
Ransomware	Blueline Associates id11464 View details	2024-04-01	United States	Communication / Marketing	pending
Blueline Associates was founded in 2005 as not only a general contracting company, but as a solution source for clients. Kenneth Larson, founder and owner, saw the areas for improvement in the... ID 11464
Ransomware	Sisu Healthcare id11463 View details	2024-04-01	United States	Healthcare / Pharma	pending
Sisu Healthcare Solutions is a privately held infusion therapy company that is dedicated to providing excellent clinical service to our patients, physicians and managed care customers... ID 11463
Ransomware	Graypen Ltd id11455 View details	2024-03-29	United Kingdom	Communication / Marketing	pending
Graypen Limited is part of the Graypen Group which provides high quality, award winning, independent port agency along with a number of other logistical and marine service companies which provide... ID 11455
Ransomware	Lodan Electronics Inc id11452 View details	2024-03-29	United States	Manufacturing / Engineering	pending
LoDan Electronics, Inc. was established in 1967, and has served as an industry leader, designing, manufacturing, and delivering cost effective, custom-engineered interconnect solutions. These... ID 11452
Ransomware	PSEC Church id11451 View details	2024-03-29	United States	Other	pending
The United Church of Christ is made up of 38 regional conferences, each with its own distinct identity. Pennsylvania Southeast Conference covers a diverse area: Philadelphia and its suburbs are in... ID 11451
Ransomware	Tech-Quip Inc id11450 View details	2024-03-29	United States	IT	pending
Established in 1973, Tech-Quip has grown to become one of the largest manufacturer’s representatives for instrumentation and analytical products in the Gulf Coast. Headquartered in Houston, TX... ID 11450
Ransomware	Florida Memorial University id11433 View details	2024-03-28	United States	Education	pending
The Florida Memorial University of today is ascending to excellence and stands in a position of great promise. Now a world-class institution, FMU offers undergraduate and graduate programs in high... ID 11433
Ransomware	Otolaryngology Associates id11429 View details	2024-03-27	United States	NGOs / Associations	pending
Otolaryngology Associates, P.C. is Northern Virginia's premier ear, nose, and throat medical and surgical practice, serving patients across Fairfax, Reston, and Chantilly. The organization provides comprehensive ENT care, including medical evaluations, surgical procedures, and head and neck treatments for adults and children. As a nonprofit association in the United States, it operates multiple full-service offices to deliver accessible otolaryngology services to the community. The entity was neutrally listed as a ransomware victim associated with the threat actor incransom. ID 11429
Ransomware	Otolaryngology Associates, LLC id22325 View details	2024-03-27	United States	NGOs / Associations	pending
Otolaryngology Associates, LLC is one of the largest private practice Ear, Nose, and Throat groups in the United States, with 13 convenient locations throughout Indiana in Indianapolis, Greencastle... ID 22325
Ransomware	NHS Scotland id11387 View details	2024-03-27	United Kingdom	Healthcare / Pharma	pending
3 terabytes of data will be published soon.NHSScotland currently employs approximately 140,000 staff who work across 14 territorial NHS Boards, seven Special NHS Boards and one public health... ID 11387
Ransomware	Barrie and Community Family Health Team id11375 View details	2024-03-26	Canada	Healthcare / Pharma	pending
A Family Health Team is an approach to primary health care that brings together different health care providers to co-ordinate the highest possible quality of care for you – the patient. It will... ID 11375
Ransomware	Ejército del Per id11356 View details	2024-03-25	Peru	Telecommunications	pending
We present to your attention the Mystery of Defense and the Army of Peru. As a result of a successful cyber attack, we have at our disposal a huge amount of classified information of these... ID 11356
Ransomware	Law Offices of John V. Orrick, P.L. id11355 View details	2024-03-25	United States	Finance / Legal / Insurance	pending
he Law Offices of John V. Orrick, P.L. represents clients throughout the Tampa Bay Area and Florida. Unlike many large personal injury firms, our firm provides prompt, individual service to all of... ID 11355
Ransomware	Pantana CPA id11354 View details	2024-03-25	United States	Communication / Marketing	pending
We take pride in offering exceptional financial services tailored to meet your specific needs. With a team of highly skilled and experienced professionals, we are committed to delivering accurate... ID 11354
Ransomware	Acculabs Inc id11238 View details	2024-03-16	United States	Communication / Marketing	pending
Aculabs, Inc. a full service laboratory, has provided superior quality laboratory testing for over 35 years, and is dedicated to providing serviceof our medical and scientific expertise to meet the... ID 11238
Ransomware	Liquid Environmental Solutions id11117 View details	2024-03-06	United States	Services	pending
Founded in 2002, Liquid Environmental Solutions is a full service waste management company. Liquid Environmental Solutions offers liquid and hazardous waste collection, transportation, processing... ID 11117
Ransomware	Orange Public School District id11007 View details	2024-02-28	United States	Education	pending
Vision The Orange Public School District commits to provide a safe and caring environment where each student is expected to grow and succeed. We pledge to prepare all students with equitable... ID 11007
Ransomware	Hardeman County Community Health Center id10993 View details	2024-02-27	United States	Healthcare / Pharma	pending
Hardeman County Community Health Center (HCCHC) is a Non-Profit Federal Qualified Health Center (FQHC) who provides comprehensive, integrated and quality health care services to improve the health... ID 10993
Ransomware	WEL Partners id10992 View details	2024-02-27	Canada	Construction / Real Estate	pending
Whaley Estate Litigation Partners (WEL Partners) is a Toronto based Trusts & Estates Litigation boutique practicing exclusively in estate related matters throughout Ontario.WEL advises Estate... ID 10992
Ransomware	Pacific American Fish Company Inc. id10750 View details	2024-02-10	United States	Agriculture / Food	pending
In 1970, Joseph Huh, an immigrant from South Korea, moved to the United States with a dream. With a deep passion for seafood and cooking, Joseph founded Pacific American Fish Company (PAFCO) in 1977... ID 10750
Ransomware	Black Butte Coal Co id10596 View details	2024-01-29	United States	Energy	pending
Black Butte Coal Company operates a coal mine. The Company produces high energy, low sulphur coal from a surface mine in Wyoming. ID 10596
Ransomware	Waterford Country School Inc id10595 View details	2024-01-29	United States	Education	pending
For 100 years Waterford Country School has worked to meet the special needs of children and families at risk. Our services and programs have evolved with the transitions that life and community... ID 10595
Ransomware	Benjamin Plumbing Inc id10594 View details	2024-01-29	United States	Services	pending
With only one truck and a kitchen table office, Benjamin Plumbing, Inc. has grown to become an award-winning, second generation, family-owned plumbing business serving the greater Madison, Wisconsin... ID 10594
Ransomware	CORBETT EXTERMINATING Inc id10593 View details	2024-01-29	United States	Services	pending
Pest control isn't always easy. But it is for us. Since Spencer Corbett founded Corbett Exterminating in 1976, Corbett has successfully managed to control pests for both residential and commercial... ID 10593
Ransomware	North American University id10591 View details	2024-01-29	United States	Education	pending
NAU is a private, non-profit, full-service college offering baccalaureate degree programs in three disciplines with several concentrations. We are located in South Houston, a few miles away from the... ID 10591
Ransomware	OrthoNY, Orthopedic Care id10573 View details	2024-01-25	United States	Communication / Marketing	pending
OrthoNY is a group of physicians, physician assistants and nurse practitioners, engaging within the orthopaedic care industry. The practice has locations in the greater Capital/Saratoga Region... ID 10573
Ransomware	Sykes Consulting, Inc. id10474 View details	2024-01-19	United States	Services	pending
Founded in 2001, by Darien M. Sykes, PE, SE, Sykes Consulting provides structural engineering consulting for public and private sector markets locally, nationally, and internationally. The firm... ID 10474
Ransomware	Washington School For The Deaf id10407 View details	2024-01-12	United States	Education	pending
ESTABLISHED IN 1886 Washington School for the Deaf is the state of Washington’s only ASL-English bilingual school serving deaf and hard or hearing students in Pre-K through 12th grade.WSD’s... ID 10407
Ransomware	CellNetix Pathology & Laboratories, LLC id10370 View details	2024-01-08	United States	Healthcare / Pharma	pending
CellNetix Pathology & Laboratories is a dynamic, rapidly growing private pathology company headquartered in Tukwila, WA, and serving hospitals and clients throughout the Pacific Northwest. CellNetix... ID 10370
Ransomware	Xerox Corp id10338 View details	2023-12-30	United States	IT	pending
Xerox Corporation provides document management solutions worldwide. The companys Document Technology segment offers desktop monochrome and color printers, multifunction printers, copiers, digital... ID 10338
Ransomware	Unite Here id10231 View details	2023-12-20	United States	Hospitality / Food & Beverage / Tourism	pending
UNITE HERE is a labor union in the United States and Canada with roughly 300,000 active members. The union's members work predominantly in the hotel, food service, laundry, warehouse, and casino... ID 10231
Ransomware	New York School of Interior Design id10049 View details	2023-12-16		Education	pending
The New York School of Interior Design enters its 2023-2026 strategic plan with renewed confidence in knowing that despite facing unprecedented changes in the last several years, it stands firm in... ID 10049
Ransomware	King Aerospace, Inc. id9983 View details	2023-12-13		Transportation / Travel / Logistics	pending
King Aerospace, Inc. (KAI) is a global operation that serves the U.S. military and government to deliver responsive aircraft maintenance and logistics support in some of the world's most hostile... ID 9983
Ransomware	Precision Technologies Group Ltd id9910 View details	2023-12-07		IT	pending
One group. Three world-class divisions. That’s PTG. An organisation that specialises in the creation of highly sophisticated rotor milling, rotor grinding and friction stir welding machines — as well... ID 9910
Ransomware	Tri-city Medical Center id9891 View details	2023-12-07		Public Sector	pending
Tri-City Medical Center has served San Diego County’s coastal communities of Carlsbad, Oceanside and Vista, as well as the surrounding region for more than 60 years and is one of the largest... ID 9891
Ransomware	Kellett & Bartholow PLLC id9818 View details	2023-12-01		Hospitality / Food & Beverage / Tourism	pending
At Kellett & Bartholow PLLC, we help consumers protect their rights and their financial interests with skilled, aggressive representation in both individual and class action lawsuits, combining more... ID 9818
Ransomware	B+P Gerüstbau GmbH id9682 View details	2023-11-23	Germany	Construction / Real Estate	pending
For more than 40 years, we have been involved in the most exciting construction projects in the country throughout Germany. With our team of over 420 colleagues, we do great things every day anew... ID 9682
Ransomware	DM Civil Co. id9681 View details	2023-11-23	Australia	Communication / Marketing	pending
DM Civil Co. is a privately owned civil contracting company based in Perth, Western Australia, with its headquarters in Maddington. Established in 1976, it provides tailored civil contracting solutions and civil engineering services to a range of Australian companies, with a focus on infrastructure delivery. Public business listings and company profiles describe it as a civil contractor serving the Western Australian market. DM Civil Co. was listed as a ransomware victim associated with incransom. ID 9681
Ransomware	DM Civil Construction Co id22324 View details	2023-11-23	Australia	Construction / Real Estate	pending
DM Civil is a privately owned company established in 1976 by Reg Toohey, Tony Spanjers and his late brother Eric Spanjers. Since then, we have grown to be one of Western Australia’s most trusted and... ID 22324
Ransomware	Ingo Money Inc id9680 View details	2023-11-23		NGOs / Associations	pending
On a Mission to Make Money Movement Instant, Digital and Secure Since 2001, we have focused on a singular mission: to give people and businesses instant, digital and secure access to their money... ID 9680
Ransomware	Nicole Miller id9679 View details	2023-11-23		Communication / Marketing	pending
NICOLE MILLER is a global fashion and lifestyle brand headquartered in New York City. Founded in 1982, the iconic brand has grown to be one of the premier names in American fashion. With an emphasis... ID 9679
Ransomware	Pro Metals LLC id9678 View details	2023-11-23		Manufacturing / Engineering	pending
When John Olivarez and a business partner started Pro Metals in 2007 it was located in a small 2,400 square foot building in Kansas City, Kansas. Mr. Olivarez took sole ownership of Pro Metals in... ID 9678
Ransomware	Springfield Area Chamber of Commerce id9677 View details	2023-11-23		Communication / Marketing	pending
Founded in 1919 and headquartered in Springfield, Missouri, Springfield Area Chamber of Commerce is a private, not-for-profit organization. The organization serves as the principal advocate for... ID 9677
Ransomware	Trylon TSF Inc. id9676 View details	2023-11-23		Manufacturing / Engineering	pending
Trylon has been supplying innovative, cell site steel infrastructure, as well as site acquisition, engineering services, installation and technical services for wireless networks since the... ID 9676
Ransomware	WellLife Network Inc. id9606 View details	2023-11-17	United States	Telecommunications	pending
Today, with an annual operating budget of $100 million, a workforce of 1,800 staff, interns and volunteers and an affiliate subsidiary company, WellLife Network delivers critical services in the... ID 9606
Ransomware	Decatur Independent School District id9586 View details	2023-11-17		Education	pending
Decatur Independent School District is a public school district based in Decatur, Texas, northwest of Fort Worth. In addition to Decatur, the district also serves portions of New Fairview and Rhome... ID 9586
Ransomware	Consilium staffing llc id9585 View details	2023-11-17		Healthcare / Pharma	pending
Consilium Staffing is a locum tenens company that connects contract healthcare providers with understaffed medical facilities. The company offers locum tenens, healthcare staffing, physician... ID 9585
Ransomware	Yamaha Motor Philippines,Inc. id9584 View details	2023-11-17	Philippines	Communication / Marketing	pending
Yamaha Motor Philippines,Inc. strives to realize people’s dreams with ingenuity and passion, a company that the community recognizes and counts on for the next electrifying innovation that provides... ID 9584
Ransomware	Guardian Alarm id9583 View details	2023-11-17		Communication / Marketing	pending
We design, install, and maintain your fire safety systems, anti-intrusion alarms and video surveillance in Indre-et-Loire and neighboring departments, but also at the national level for large-scale projects. ID 9583
Ransomware	SCOLARI Srl id9582 View details	2023-11-17	Brazil	Manufacturing / Engineering	pending
Founded in 1950, our business began with the production of manual or semi-automatic open-plan systems. Currently, thanks to a constantly evolving technology, we build systems with integral air... ID 9582
Ransomware	EFU Life Assurance id9413 View details	2023-11-06	Pakistan	Finance / Legal / Insurance	pending
efuinsurance.com represents EFU General Insurance, a Pakistan-based insurer and one of the country’s leading non-life insurance companies. Its business covers insurance solutions for retail, SME, and corporate customers, with products that include property, engineering, fire, marine, aviation, cargo, hull, motor, and related services. EFU also describes itself as the mother company of other EFU Group insurance organizations and notes specialist operations such as health and takaful offerings in Pakistan. The site was listed as a ransomware victim associated with incransom. ID 9413
Ransomware	EFU Life Assurance Ltd id22323 View details	2023-11-06	Pakistan	Finance / Legal / Insurance	pending
EFU Group, originally Eastern Federal Union Insurance Company Limited, is a Pakistan based insurance company. It was the first insurance company in India founded in (1932) owned by the Muslims based... ID 22323
Ransomware	Livability id9367 View details	2023-11-03	United Kingdom	Hospitality / Food & Beverage / Tourism	pending
Livability is the charity that’s committed to enabling people with disabilities to live the life they want to lead. We work to change what is unlivable, helping people to tackle the barriers they... ID 9367
Ransomware	Universal Sewing Supply id9303 View details	2023-10-31	United States	Manufacturing / Engineering	pending
Universal Sewing Supply is a US-based supplier in the manufacturing and engineering space, headquartered in St. Louis, Missouri. The company provides industrial sewing equipment, supplies, and parts, including components used in sewn-products production and related shop operations. Public company profiles describe it as a long-standing distributor with a large catalog and distribution-focused service model. It was listed as a ransomware victim associated with incransom. ID 9303
Ransomware	Universal Sewing Supply Inc id22322 View details	2023-10-31	United States	Manufacturing / Engineering	pending
Universal Sewing Supply was founded in 1956 in St. Louis, Missouri. Universal Sewing Supply provides industrial sewing equipment, supplies, and parts as well as air line components, valves, air hoses... ID 22322
Ransomware	Global Export Marketing Co. Ltd. id9264 View details	2023-10-30		Communication / Marketing	pending
GEMCO is a pioneering company that helps American international brands to reach out to the world. We are driven by quality, service, reliability, and our success over the last 31 years has been... ID 9264
Ransomware	Alam Flora Sdn Bhd id9245 View details	2023-10-27	Malaysia	Services	pending
Incorporated in 1995, Alam Flora Sdn Bhd (Alam Flora) is the leading environmental management companies in Malaysia that is dedicated to serving communities to manage and reduce waste with minimal... ID 9245
Ransomware	Direct Mail Corporation id9225 View details	2023-10-25	Australia	Services	pending
From humble beginnings in 1994, Direct Mail Corporation has grown to become one of Melbourne’s most respected Mail Houses, servicing Internet businesses, book publishers, event managers, marketers... ID 9225
Ransomware	Greenpoint id9112 View details	2023-10-17		IT	pending
Greenpoint Technologies is a business jet completion center based in Bothell, Washington, and it provides turnkey interior solutions for large executive aircraft. The company serves private clients, governments, heads of state, and corporate aviation customers, with work spanning design, engineering, certification, and refurbishment. Greenpoint has also described itself as part of the Safran group and operates across multiple Washington and Texas locations. In threat-intelligence listings, greenpointtech.com was identified as a ransomware victim associated with incransom. ID 9112
Ransomware	Greenpoint Technologies Inc id22321 View details	2023-10-17	United States	IT	pending
Established in 1987, Greenpoint Technologies is one of the original licensed Business Jet Completion Centers providing turnkey interior completions for private individuals, corporations and Heads of... ID 22321
Ransomware	Catholic Charities id9083 View details	2023-10-13		Public Sector	pending
Catholic Charities of Broome County is the lead agency in the joint initiative, called Encompass Family Health Home, which was selected back in June 2015 by the New York State Department of Health as... ID 9083
Ransomware	Cleveland City Schools id9080 View details	2023-10-13	United States	Education	pending
Cleveland City Schools is a public school system located in Cleveland, Tennessee. We serve over 5,000 students across nine schools, including seven elementary schools, one middle school, and one high... ID 9080
Ransomware	Vicon industries inc. id9062 View details	2023-10-12	United States	Healthcare / Pharma	pending
Vicon is a global leader in advanced security and surveillance technology to safeguard businesses, schools, municipalities, hospitals and cities across the world. We specialize in engineering... ID 9062
Ransomware	Village Building Co. id9043 View details	2023-10-11	Australia	Construction / Real Estate	pending
We encourage a mix of integrated single title and multi‑unit housing in order to create strong, vibrant and diverse communities and to achieve socially responsible densities. Our communities are... ID 9043
Ransomware	Sobieski id9037 View details	2023-10-11		Other	pending
A Vision For the Future “35 years ago, J. F. Sobieski, Inc. was founded with a clear idea of what we would need for a successful future.”– John F. Sobieski, III, CEO Founded more than thirty-five... ID 9037
Ransomware	Jacobsen Construction id8881 View details	2023-09-28		Construction / Real Estate	pending
We present to you - jacobsenconstruction.com We use an uncommon and empowering employee-ownership structure that creates significant long-term financial opportunities for the workforce; promotes... ID 8881
Ransomware	Agilitas IT Solutions Limited id8748 View details	2023-09-22		Services	pending
We have been contacted by representative of the Agilitas IT Services company. Through long negotiation process we have proved that source code of applications made by Agilitas IT Services and other... ID 8748
Ransomware	ENTRUST Solutions Group id8702 View details	2023-09-20		Services	pending
ENTRUST Solutions Group is a community of people, 3,100+ strong, who are committed to our clients and each other. We are diverse, talented, dedicated, and wholly focused on not only meeting the needs... ID 8702
Ransomware	Federal Labor Relations Authority id8701 View details	2023-09-20	United States	Public Sector	pending
The Federal Labor Relations Authority (FLRA) is an independent agency of the United States government that governs labor relations between the federal government and its employees. ID 8701
Ransomware	Leoch Battery id8700 View details	2023-09-20		Energy	pending
LEOCH Battery is a China-based energy company founded in 1999 and headquartered in Anhui Province, with operations focused on advanced battery power and energy management solutions. Its portfolio includes lead-acid batteries, lithium energy storage systems, backup power supplies, automotive start-stop batteries, and motive power products for industrial, commercial, residential, grid-side, and renewable energy uses. The company describes itself as a global leader in energy storage and battery manufacturing, serving a broad range of power applications. It was listed as a ransomware victim associated with incransom. ID 8700
Ransomware	Leoch Battery Corp id22320 View details	2023-09-20		Energy	pending
Products Lithium Battery Lithium solutions are mainly used in network power, green energy storage and transportation with high energy density, exceptional performance, and long life. Leoch has a... ID 22320
Ransomware	Elemetal id8677 View details	2023-09-18		Manufacturing / Engineering	pending
Elemetal is one of the largest precious metals refiner. They are laundering money for drug cartel and can't find a small amount to prevent data leak. Cost of their privacy is $160.000. 600GB of... ID 8677
Ransomware	************ id8675 View details	2023-09-18		Communication / Marketing	pending
************ one of the largest precious metals refiner. they are laundering money for drug cartel and can't find a small amount to prevent data leak. we will name company on Friday if there will be... ID 8675
Ransomware	Abbeyfield id8598 View details	2023-09-12		Construction / Real Estate	pending
It's our mission to provide the best service of care and housing for all our residents, and to be a champion for older people. ID 8598
Ransomware	I Keating Furniture World id8521 View details	2023-09-06		Retail / E-commerce	pending
I. Keating Furniture World is a family owned Furniture & Mattresses store located in Minot, ND. ID 8521
Ransomware	It4 Solutions Robras id8517 View details	2023-09-06	United States	Services	pending
It4 Solutions Robras Corp is a company that operates in the Information Technology and Services industry. ID 8517
Ransomware	Arkopharma id8453 View details	2023-09-03		Healthcare / Pharma	pending
Arkopharma in brief Arkopharma is a pharmaceutical laboratory specialised in the area of phytotherapy, natural medicine and dietary supplements. ID 8453
Ransomware	Pifer's Auction & Realty id8398 View details	2023-08-31		Construction / Real Estate	pending
Pifer's Auction & Realty is a full service auction and real estate firm specializing in land auctions, machinery auctions, and land management. ID 8398
Ransomware	Hemmink id8150 View details	2023-08-16		Other	pending
say hello martin! you have very bad it specialists ID 8150
Ransomware	Thermenhotel Stoiser id8105 View details	2023-08-09		Hospitality / Food & Beverage / Tourism	pending
ENJOY! ID 8105

‹ Prev 1 … 4 5 6 7 8 9 10 Next ›

Incransom

Overview

Leak Status Distribution

Top Countries

Known Leak Locations (7)

Top Activity Sectors (18)