INC Ransom
Russian-speaking ransomware-as-a-service operation active since mid-2023, notable for sustained targeting of UK NHS trusts and U.S. healthcare providers. Major UK incidents: **NHS Dumfries and Galloway** (March 2024 — 3TB exfiltrated, 150,000 patient records subsequently leaked when ransom was refused), **NHS Alder Hey Children's Hospital + Liverpool Heart and Chest** (November 2024). The brand's source code was reportedly sold by an operator on RAMP forum in May 2024 for $300,000 — Lynx ransomware (active since mid-2024) is the suspected derivative.
Aliases
Motivations
Target sectors
Target countries
Diamond Model
Caltagirone / Pendergast / Betz 2013 — four-vertex attribution framework.
MITRE ATT&CK techniques
Timeline
2 events- CompromiseCritical2024-11-28·The Register
INC Ransom claims compromise of Alder Hey Children's + Liverpool Heart NHS
INC Ransom claimed near-simultaneous compromises of two Liverpool-area NHS Foundation Trusts: Alder Hey Children's Hospital (one of the UK's largest paediatric hospitals) and Liverpool Heart and Chest. The operators posted patient documents on their leak site as proof, marking the second sustained INC Ransom campaign against UK NHS trusts in eight months. The Alder Hey targeting — paediatric oncology and cardiology data — drew unusually pointed condemnation from UK government and healthcare-sector commentators.
healthcareransomwarepaediatricuknhs - CompromiseHigh2024-03-15·The Register
INC Ransom compromises NHS Dumfries and Galloway, leaks 150K patient records
INC Ransom claimed a compromise of NHS Dumfries and Galloway, the regional NHS Scotland trust serving south-west Scotland, on 15 March 2024. The trust contained malware spread to a single regional branch but could not prevent exfiltration; the operators claimed 3TB of stolen data. After the trust refused to pay, INC Ransom published patient records — including medical test results for adults and young children, medication information, and full patient names + home addresses — ultimately exposing approximately 150,000 individuals' data on the operators' leak site.
healthcareransomwareuknhspatient-impact
Indicators of compromise
2 indicators| Type | Value | First seen | Source |
|---|---|---|---|
| Name | family · INC Ransomware Ransom note filename dropped per directory by INC Ransom (also seen as INC-README.html / *.inc-readme.txt). Documented in Huntress and Secureworks (GOLD IONIC) analyses. | Jul 31, 2023 | Sophos / Secureworks CTU |
| SHA-256 | family · INC Ransomware INC Encryptor binary (PDB string 'C:\source\INC Encryptor\Release\INC Encryptor.pdb') used in the early INC Ransom intrusions investigated by Huntress and mapped to MITRE ATT&CK software entry S1139. | Jul 31, 2023 | Huntress |
Leak-site activity (unverified)
full feed →Recent victim disclosures posted by this group on its leak site, via ransomware.live. These are unverified attacker claims — ransomware crews routinely fabricate, double-post, or inflate victims. Surface only.
Related actors
shared ATT&CK techniques- ?? · UnknownALPHV/BlackCat4 shared techniques
- RU · RussiaDarkSide4 shared techniques
- RU · Russia8Base3 shared techniques
- ?? · UnknownAkira3 shared techniques
- RU · RussiaConti3 shared techniques
- ?? · UnknownHive3 shared techniques
References
cite this page
Threat Intel Tracker. (2026-05-19). INC Ransom — actor profile. Retrieved from https://threatintel.local/actors/inc-ransom