Easterseals Arc of Northeast Indiana listed by Inc Ransom

• Ransomware group: Inc Ransom
• Country: United States
• Sector: Government & Defense
• Announcement date: November 10, 2025

Inc Ransom claims data exfiltration from Easterseals Arc of Northeast Indiana

The threat actor known as Inc Ransom has listed the non-profit organization Easterseals Arc of Northeast Indiana on its leak site. According to the group's announcement, the attackers claim to have successfully exfiltrated a significant volume of data from the organization's systems. This listing serves as a public disclosure of the group's claims regarding the organization's data, marking a potential security incident for the US-based entity.

Ransomware leak sites are platforms operated by cybercriminal groups to pressure victims into paying ransoms. These sites are used to host announcements, sometimes accompanied by screenshots or file lists, to demonstrate the success of an intrusion. When a group lists a target, it often signals that negotiations have failed or that the group is moving toward a public disclosure phase of their operation.

Details of the alleged attack

The incident involving Easterseals Arc of Northeast Indiana was announced on the Inc Ransom leak site on November 10, 2025. While the announcement was made in November, the group claims the actual attack occurred much earlier, specifically on September 5, 2025. This discrepancy between the time of the breach and the public disclosure is a common occurrence in ransomware operations, as attackers may spend months conducting reconnaissance, exfiltrating data, or attempting to negotiate with the victim before going public.

The group's claims regarding the scale of the breach are substantial. According to the information provided by the threat actor, the volume of data allegedly stolen from the organization's systems is 405 GB. This volume of data suggests a significant intrusion into the organization's digital infrastructure, though the specific nature of the files remains unconfirmed by the victim.

Data involved in the claim

The listing provides information regarding the total volume of the data, but it does not provide specifics regarding the contents. The listing names no specific data types.

About Easterseals Arc of Northeast Indiana

Easterseals Arc of Northeast Indiana is a non-profit organization that provides life-enhancing services, employment readiness programs, and social support activities for individuals with disabilities and their families. Operating in northeast Indiana, the organization aims to empower participants and foster their inclusion in the community.

Potential impact and security considerations

This alleged breach may pose significant privacy risks for the individuals with disabilities and their families served by the organization. Given the nature of the services provided, the compromised data could potentially include sensitive information. As a US-based entity, any potential data compromise could fall under the scope of regulations such as HIPAA regarding protected health information, which mandates strict protections for sensitive patient data.

The tactics employed by Inc Ransom often involve double extortion. In a double extortion scheme, attackers do not just encrypt an organization's data to disrupt operations; they also steal sensitive information to use as leverage. If a victim refuses to pay the ransom to decrypt their systems, the attackers threaten to leak the stolen data publicly. This method increases the pressure on the organization, as the threat of a data leak can lead to severe reputational damage, legal liabilities, and secondary attacks, such as identity theft schemes targeting the individuals whose data was stolen.

For organizations operating in the non-profit and social service sectors, such incidents can lead to operational disruptions that may have indirect impacts on their broader service network. To defend against such threats, organizations typically implement various security measures, including regular data backups, multi-factor authentication, and continuous monitoring of their networks to detect unauthorized access or large-scale data transfers. Maintaining compliance with data protection regulations is also a critical component of a robust cybersecurity posture for entities handling sensitive personal and health information.