INC Ransom 2026 activity
Ransomware group. 8 reports in 7 countries: 2 confirmed, 6 claimed or disputed. Latest 31 Aug 2026.
Malaysia · 
Indonesia · 
Vietnam · 
Sweden · 
Singapore · 
Saudi Arabia · 
Cambodia
🎯 What sources say
- Singapore: Claimed SGX-listed LHT Holdings in March 2026 after the company disclosed encrypted systems. ransomware.live
- Vietnam: Listed Vedan in July and Geleximco in August 2026. ransomware.live
🚨 Reports
| Organisation | Country | Date | Sector | Type | Actor | What happened | Sources |
|---|---|---|---|---|---|---|---|
 ⚠️ ClaimedCIMB SecuritiesKuala Lumpur | Malaysia | 31 Aug 2026 | Finance | Ransomware | INC Ransom | Claimed. cimbsecurities.com listed on INC Ransom's leak site. | ransomware.live✓ 7 Nov |
 ⚠️ ClaimedPusat Hidro-Oseanografi TNI AL (Pushidrosal) | Indonesia | 4 Aug 2026 | Government | Ransomware | INC Ransom | Claimed. INC Ransom listed pushidrosal.id, the navy hydro-oceanographic centre, on its leak site. | ransomware.live✓ 7 Nov |
| ⚠️ ClaimedGeleximco (geleximco.vn) | Vietnam | 4 Aug 2026 | Other | Ransomware | INC Ransom | Claimed. INC Ransom listed the conglomerate's domain on 4 August 2026 and claimed 200 GB of data. | ransomware.live✓ 7 Nov |
 ⚠️ ClaimedVedan Vietnam | Vietnam | 18 Jul 2026 | Manufacturing | Ransomware | INC Ransom | Claimed. INC Ransom listed Vedan Corp on its leak site on 18 July 2026. | ransomware.live✓ 7 Nov |
| ✅ ConfirmedDorotea and Vilhelmina municipalities | Sweden | 9 Apr 2026 | Government | Ransomware | INC Ransom | Confirmed. An attack found on 9 April took down IT systems in both Västerbotten municipalities. Dorotea warned that personal data may have leaked. Claimed. INC Ransom listed Dorotea on its leak site on 24 April. | SVT · ransomware.live✓ 8 Nov |
 ✅ ConfirmedLHT Holdings | Singapore | 4 Mar 2026 | Manufacturing | Ransomware | INC Ransom | Confirmed. SGX-listed LHT Holdings said unauthorised access to certain IT systems led to encryption of selected systems, the incident was contained, and it found no evidence of personal or confidential data being accessed or exfiltrated. Claimed. The Incransom group listed LHT Holdings Limited on its leak site on 10 March 2026. | Tiger Brokers (company announcement) · ransomware.live✓ 7 Nov |
 ⚠️ ClaimedACWA Power | Saudi Arabia | 24 Feb 2026 | Energy | Ransomware | INC Ransom | Claimed. INC Ransom listed ACWA Power on its leak site. The company has not commented. | Breachsense✓ 8 Nov |
 ⚠️ ClaimedChokChey Finance | Cambodia | 2 Feb 2026 | Finance | Ransomware | INC Ransom | Claimed. INC Ransom listed the microfinance lender on its leak site. | ransomware.live✓ 8 Nov |
Leak-site listings are claims until the organisation or authorities confirm them. Methodology