INC Ransom Targeted 24 Law Firms, but Only 10 are Listed

SOCRadar observed an INC Ransom campaign in March 2026 that created 24 individualized clearnet extortion pages (patterned as [firm-name]-leak.com) targeting US law firms and their clients; 10 of the 24 firms later appeared on INC’s leak site while 14 did not, suggesting many incidents may have been resolved off the public leak site. The tactic leverages client-facing pressure (countdown timers, 'Staff of Shame' galleries, and direct messaging to clients) to increase reputational and legal stakes for victims and may be replicated against other client-facing sectors.