THREAT WATCH · September 28, 2026 · RANSOMWARE LISTING

INCRANSOM Lists nsbsd.org on Ransomware Tracker

nsbsd.org, a United States-based organization with between 51 and 100 employees, was recorded on the INCRANSOM ransomware tracker on September 28, 2026. The listing has not been publicly disclosed by the organization. A tracker listing is a strong signal of compromise but does not confirm a breach on its own.

Key takeaways

• nsbsd.org was recorded on the INCRANSOM tracker on September 28, 2026
• The organization has not publicly acknowledged the listing
• A tracker listing is a strong signal but does not confirm a breach
• Mid-sized US organizations remain frequent ransomware targets

What the listing shows

• Organization: nsbsd.org
• Domain: nsbsd.org
• Ransom group: INCRANSOM
• Listing date: September 28, 2026
• Country: United States
• Sector: Other
• Company size: 51-100 employees
• Disclosure status: Not disclosed yet

What a ransomware listing means

A listing on an attacker-side tracker means the ransom group claims to have obtained data from the organization and is threatening to publish it. This is a strong indicator of compromise but is not proof of a confirmed breach. Attackers sometimes list organizations they did not successfully compromise, or they may exaggerate the scope of access they obtained. Intel128 records listings as they appear and treats them as high-priority signals requiring further investigation.

Disclosure status

As of the time of this recording, nsbsd.org has not publicly acknowledged the listing. Organizations that appear on trackers but have not disclosed may be in the process of investigating the incident, negotiating with the group, or preparing a public statement. The absence of a public disclosure does not mean the listing is false, nor does it confirm the attackers' claims. Intel128 will update this entry if the disclosure status changes.

What organizations should do

• Check whether your own domain or brand appears on known ransomware trackers on a regular basis.
• If you are listed, begin an incident response process immediately rather than waiting for the data to be published.
• Preserve logs and forensic evidence before making any public statement or taking systems offline.
• Engage legal counsel and, if appropriate, law enforcement to understand your obligations.
• Review your disclosure requirements under applicable regulations, including any contractual notification duties to clients or partners.
• Assess whether the data the group claims to hold matches what you can verify internally.

Context for decision-makers

Mid-sized organizations with 51 to 100 employees are frequent targets for ransomware groups. These organizations often hold enough sensitive data to be valuable to attackers but may lack the dedicated security teams and incident response capabilities that larger enterprises maintain. The sector classification "Other" means the organization does not fall into a standard industry category tracked by Intel128, which can make it harder for peer organizations to assess whether they share similar risk profiles.

The INCRANSOM group is the ransomware operation associated with this specific listing. Intel128 does not attribute additional campaigns or tactics to this group beyond what is recorded in our tracker.

Intel128 monitoring

Intel128 continuously monitors attacker-side ransomware trackers and records new listings as they appear. Our goal is to give security teams and executives early awareness so they can act before data is published or before a listing becomes public news. If you operate in a similar sector or size range, treat this listing as a prompt to review your own exposure and response readiness.

SOURCE: INTEL128 THREAT INTELLIGENCE FEED (UPDATED OCT 01, 2026). A listing is a record on an attacker-side ransomware tracker - strong signal, not a confirmed breach. Intel128 publishes what the feed shows and no more.