INC Ransom
Double extortion across healthcare and the public sector. Its codebase was reportedly sold and underpins the Hunters International and Lynx lineages.
Claimed victims
459
Top region
US
Top sector
Professional Services
Suspected origin
Unattributed
Latest claimed victims
Victims as claimed by the group on its leak site and tracked in our graph — claims are not independently verified, and listing here is not confirmation a breach occurred.
| Date | Organisation (claimed) | Sector | Country |
|---|---|---|---|
| 2026-10-02 | Sangre de Cristo Electric Association | Energy & Utilities | US |
| 2026-10-01 | Rimrock Foundation | Other | US |
| 2026-10-01 | Guardian Pharmacy LLC | Healthcare | US |
| 2026-10-01 | Den Hartog Industries | Manufacturing | US |
| 2026-10-01 | Northern Counties Health Care | Healthcare | US |
| 2026-10-01 | Post Metal Recycling | Manufacturing | US |
| 2026-09-29 | bcx.co.za | Technology | ZA |
| 2026-09-28 | bakemyday.se | Retail & E-Commerce | SE |
| 2026-09-28 | AHEAD | Not Found | US |
| 2026-09-28 | nsbsd.org | Government & Defense | US |
Regions targeted
Sectors targeted
Suspected affiliates & lineage
Ransomware crews share affiliates, tooling and operators; brands fall and reappear under new names. Related to:
Track it daily
Ransomware moves every day. So does our paper.
The Probably Fine Daily is our morning threat-intelligence briefing — new victims, new groups, what actually matters, in plain English. Free.
Read today's Daily →Browse the archiveDefender-oriented threat intelligence. Nothing here assists an attack. Attribution and lineage reflect open-source reporting.