Dark ReadingAlexander Culafi
INC ransomware hits over 800 victims, targets healthcare sector
Part of the Inc story · since 29 Apr
Quiet for 10 dayslast report 23 Oct12 articles5 outlets
- Wed 29 Apr, 16:11 UTC. DataBreaches, first report. Sandhills Medical breach leaks 169k records via INC Ransom.
- Wed 17 Jun, 20:48 UTC. Dark Reading, its first report on the story. INC ransomware hits over 800 victims, targets healthcare sector. This article, 2nd of 12.
- Thu 18 Jun, 15:10 UTC. The Hacker News, its first report on the story. INC ransomware jumps as RaaS threat, over 830 victims since 2023.
- Thu 2 Jul, 09:21 UTC. The Hacker News. FortiBleed Credential Theft Fuels INC and Lynx Ransomware Surge.
- Thu 2 Jul, 11:11 UTC. Security Affairs, its first report on the story. FortiBleed Campaign Fuels Ransomware on 430k FortiGate Devices.
- Thu 2 Jul, 20:12 UTC. Dark Reading. FortiBleed breach fuels ransomware risk for Inc and Lynx gangs.
- Fri 17 Jul, 21:01 UTC. Dark Reading. SonicWall CVE-2026-15409 flaw lets ransomware group hijack VPNs. Cites a CVE in CISA KEV.
- Wed 9 Sep, 12:26 UTC. DataBreaches. New Jersey School District Network Outage Linked to Ransomware Attack.
- Tue 20 Oct, 10:43 UTC. SecurityOnline, its first report on the story. Ransomware gangs bypass MFA through PAN OS VPN flaw CVE-2026-0257. Cites a CVE in CISA KEV.
- Tue 20 Oct, 16:13 UTC. The Hacker News. Qilin and INC ransomware gangs exploit Palo Alto VPN flaw to bypass MFA. Cites a CVE in CISA KEV.
- Tue 20 Oct, 16:48 UTC. DataBreaches. Ransomware gangs exploit patched Palo Alto VPN security flaw. Cites a CVE in CISA KEV.
- Fri 23 Oct, 18:36 UTC. The Hacker News. AI Agents Power Ransomware Affiliates’ Attacks on Edge Devices. Cites a CVE in CISA KEV.
The article discusses the rise of the ransomware group INC, which specializes in ransomware-as-a-service (RaaS) and has achieved notable success by targeting vulnerable sectors such as healthcare, where victims face immediate operational pressure to pay ransoms. INC has targeted over 800 victims since its emergence in 2023, benefiting from the collapse of rival groups like ALPHV/BlackCat and LockBit.
The organization employs familiar intrusion tactics, such as spearphishing and exploiting well-known vulnerabilities. It uses double extortion strategies, pushing the urgency for payments from victims by threatening data leaks. Key factors behind INC's effectiveness include aggressive victim selection, rapid scaling of affiliate partnerships, and a focus on established, high-pressure sectors. Recommendations for organizations include implementing robust data backup strategies and enhancing security measures to mitigate risks.
How the story developed
Quiet for 10 dayslast report 23 Oct12 articles5 outlets
12 articles from 5 outlets since 29 Apr. Quiet since 23 Oct. This was the 2nd report, 49 days after the first.
- Wed 29 Apr, 16:11 UTC. DataBreaches, first report. Sandhills Medical breach leaks 169k records via INC Ransom.
- Wed 17 Jun, 20:48 UTC. Dark Reading, its first report on the story. INC ransomware hits over 800 victims, targets healthcare sector. This article, 2nd of 12.
- Thu 18 Jun, 15:10 UTC. The Hacker News, its first report on the story. INC ransomware jumps as RaaS threat, over 830 victims since 2023.
- Thu 2 Jul, 09:21 UTC. The Hacker News. FortiBleed Credential Theft Fuels INC and Lynx Ransomware Surge.
- Thu 2 Jul, 11:11 UTC. Security Affairs, its first report on the story. FortiBleed Campaign Fuels Ransomware on 430k FortiGate Devices.
- Thu 2 Jul, 20:12 UTC. Dark Reading. FortiBleed breach fuels ransomware risk for Inc and Lynx gangs.
- Fri 17 Jul, 21:01 UTC. Dark Reading. SonicWall CVE-2026-15409 flaw lets ransomware group hijack VPNs. Cites a CVE in CISA KEV.
- Wed 9 Sep, 12:26 UTC. DataBreaches. New Jersey School District Network Outage Linked to Ransomware Attack.
- Tue 20 Oct, 10:43 UTC. SecurityOnline, its first report on the story. Ransomware gangs bypass MFA through PAN OS VPN flaw CVE-2026-0257. Cites a CVE in CISA KEV.
- Tue 20 Oct, 16:13 UTC. The Hacker News. Qilin and INC ransomware gangs exploit Palo Alto VPN flaw to bypass MFA. Cites a CVE in CISA KEV.
- Tue 20 Oct, 16:48 UTC. DataBreaches. Ransomware gangs exploit patched Palo Alto VPN security flaw. Cites a CVE in CISA KEV.
- Fri 23 Oct, 18:36 UTC. The Hacker News. AI Agents Power Ransomware Affiliates’ Attacks on Edge Devices. Cites a CVE in CISA KEV.
- Known exploited CVE
- No CVE
- Larger: an outlet’s first report
- Coverage over time
- Quiet time, folded
Show all 12 articles as a listHide the list
- Wed 29 AprDay 01
- Sandhills Medical breach leaks 169k records via INC Ransom16:11 · DataBreaches · First report
Quiet for 7 weeks
Wed 17 JunDay 491- INC ransomware hits over 800 victims, targets healthcare sector20:48 · Dark Reading · Picked up again · This article, 2nd of 12
- Thu 18 JunDay 501
- INC ransomware jumps as RaaS threat, over 830 victims since 202315:10 · The Hacker News
Quiet for 2 weeks
Thu 2 JulDay 643- FortiBleed Credential Theft Fuels INC and Lynx Ransomware Surge09:21 · The Hacker News · Picked up again
- FortiBleed Campaign Fuels Ransomware on 430k FortiGate Devices11:11 · Security Affairs
- FortiBleed breach fuels ransomware risk for Inc and Lynx gangs20:12 · Dark Reading
Quiet for 2 weeks
Fri 17 JulDay 791- SonicWall CVE-2026-15409 flaw lets ransomware group hijack VPNs21:01 · Dark Reading · Exploited CVE · Picked up again · Known exploited CVE
Quiet for 8 weeks
Wed 9 SepDay 1331- New Jersey School District Network Outage Linked to Ransomware Attack12:26 · DataBreaches · Picked up again
Quiet for 6 weeks
Tue 20 OctDay 1743- Ransomware gangs bypass MFA through PAN OS VPN flaw CVE-2026-025710:43 · SecurityOnline · Picked up again · Known exploited CVE
- Qilin and INC ransomware gangs exploit Palo Alto VPN flaw to bypass MFA16:13 · The Hacker News · Known exploited CVE
- Ransomware gangs exploit patched Palo Alto VPN security flaw16:48 · DataBreaches · Known exploited CVE
Quiet for 3 days
Fri 23 OctDay 1771- AI Agents Power Ransomware Affiliates’ Attacks on Edge Devices18:36 · The Hacker News · Picked up again · Known exploited CVE