Skip to content

INC Ransom

Ransomware group active since 2023 that steals data and encrypts networks for double extortion, targeting healthcare, retail, government and industry.

Known aliases

  • INC Ransom group
  • INC ransomware

Current stories

securityConfirmed11 publishers

Ahold Delhaize keeps its stores open while some systems stay offline after a cyber incident

Ahold Delhaize, operator of more than 9,400 stores, confirmed it took some systems offline after a cybersecurity incident. A spokesperson was not immediately available to answer BleepingComputer's questions on scope or encryption.

Publishers:bleepingcomputer.com govinfosecurity.com newsroom.aholddelhaize.com nieuws.ah.nl nos.nl retaildetail.nl retailtrends.nl securityweek.com stirileprotv.ro thecyberexpress.com therecord.media

Perspective Coverage

11 publishers
Builder
Builder 4%
Operator
Operator 74%
Investor
Investor 22%

Reality

Evidence68
Adoption
Not scored
Hype gap+12
Incentives55
Confidence70
securityOne report1 publisher

Huntress rebuilt a 175-endpoint INC ransomware case from scheduled tasks and a driver fragment

Huntress reconstructed an INC intrusion from the logs that had survived. The tradecraft it found was ordinary operator work, the kind a name-based indicator list misses, and how the attackers first got in is still an open question.

Publishers:huntress.com

Reality

Evidence62
Adoption28
Hype gap−5
Incentives65
Confidence55
securityOne report1 publisher

Ransomware hit government entities once a day through the first half of 2026

Comparitech's half-year tally shows government ransomware growing again, with the newest crew on the board, The Gentlemen, out-filing Qilin and spreading its targeting well beyond the United States.

Publishers:comparitech.com

Reality

Evidence50
Adoption60
Hype gap+20
Incentives62
Confidence55
securityOne report1 publisher

CRPx0 climbed to 46 claimed victims in July on countdowns that fired in near unison

Bitdefender logged 873 claimed ransomware victims in July, the third-highest month in a year. A brand that barely existed in June supplied 46 of them, on a leak site the analysts say they cannot fully verify.

Publishers:bitdefender.com

Reality

Evidence38
Adoption26
Hype gap+42
Incentives64
Confidence44