INC Ransom Ransomware Activity in the UAE
INC Ransom has claimed 5 organisations in the United Arab Emirates, which is 4.5% of all attributed UAE claims. Its activity concentrates in Professional Services, accounting for 1 of those claims. The first INC Ransom claim against a UAE organisation was recorded on , the most recent on .
Data as of , drawn from 192 leak-site claims collected by ransomware.live. This page counts INC Ransom claims only. How this data is collected and filtered.
Which UAE sectors INC Ransom targets
| Name | Relative volume | Incidents | Share |
|---|---|---|---|
| Professional Services | 1 | 20% | |
| Technology | 1 | 20% | |
| Manufacturing | 1 | 20% | |
| Hospitality | 1 | 20% | |
| Other | 1 | 20% | |
| Total | 5 | 100% |
When INC Ransom claimed UAE organisations
INC Ransom has claimed 5 UAE organisations across 5 different sectors, one in each, with 4 of the 5 falling in 2026.
INC Ransom has claimed 5 UAE organisations
INC Ransom ranks sixth of 47 groups on this tracker and carries 4.5% of all attributed UAE claims. It appears across 5 distinct sectors. The spread is the unusual part, not the count.
Every INC Ransom claim lands in a different sector
Leak-site monitoring recorded the first INC Ransom claim against a UAE organisation on 20 November 2025. The most recent was recorded on 7 October 2026. The group claimed 1 organisation in 2025 and 4 in the partial year 2026.
Those 5 claims sit in 5 separate sectors. Professional Services, Technology, Manufacturing, Hospitality and Other carry 1 claim each.
No sector preference is visible in the UAE data. A group reaching 5 sectors with 5 claims selects by opportunity rather than by industry. That holds on the evidence here, which is one year deep.
What this means for UAE organisations
- Do not expect a sector filter to exclude you, because this group reached 5 sectors in 5 claims.
- Note that 4 of the 5 claims fall in 2026, so the activity is recent rather than historical.
- Treat a 5 claim record as an early profile, since LockBit 3.0 leads the table with 10.
- Map obligations under the UAE Personal Data Protection Law, which applies across every sector this group touched.
- Read the sector pages rather than this one when deciding where to spend, since sectors persist while group names turn over.
INC Ransom crossed the threshold for its own page during 2026, having held 4 claims a month ago. The record is young enough that its shape may change with the next claim.
Compare this profile against Everest, which also started from nothing in 2025 but concentrated its claims in a single sector. Two groups of similar age produced opposite patterns, which is why a sector page outlives a group page.