INC Ransom

Profile narrative

INC Ransom, also known simply as INC Ransom, is a ransomware group whose activity has been traced to the United States of America. The actor has been observed since at least 2023 and was credited with 436 victim incidents between March 2025 and March 2026 according to the Black Kite Ransomware Report 2026, which listed it among the top five ransomware operations by victim count. Its targeting has spanned multiple sectors including auditing and consulting firms, insurance carriers, cultural foundations, healthcare providers, and technology subsidiaries, indicating a broad opportunistic approach rather than a narrow industry focus. The group’s apparent objective is financial gain, achieved through ransom demands that are coupled with the exfiltration of sensitive data and threats to publish the stolen information unless payment is made. Analysis of its methods notes that the actors frequently exploit critical software vulnerabilities—those with a CVSS score of 9 or higher—to gain initial access to victim networks, after which they deploy the eponymous INC Ransom malware to encrypt systems and leverage the stolen material for extortion.

Representative operations illustrate this pattern. In early 2026, Beacon Mutual Insurance Co. reported a breach claimed by INC Ransom, asserting the exfiltration of 275 GB of uncompressed files containing names, Social Security numbers, driver’s license numbers, financial account details, health insurance data, and medical records affecting over 160 000 individuals; the insurer isolated affected systems, engaged forensic experts, restored operations, notified those impacted, and cooperated with the FBI. In mid‑2025, the Biennale di Venezia suffered an attack that resulted in the theft of more than eight hundred gigabytes of data, including identity scans of artists and internal budgetary documents, with a portion leaked on the dark web; the foundation detected the intrusion, isolated networks, involved authorities, and enlisted the cybersecurity firm Yarix for recovery. Also in 2025, Sandhills Medical Foundation experienced a ransomware incident that exposed personal health information, Social Security numbers, dates of birth, and other identifiers for roughly 170 000 patients; the group posted the stolen files on its leak site, prompting a national class‑action investigation. These cases demonstrate the actor’s consistent reliance on data theft followed by extortion demands to monetize its intrusions.

Incidents

Attributed incidents are available to members.

Sources

Sources available to members: 1 source.