Horizon Family Medical Group targeted by Inc Ransom in massive data breach claim

• Ransomware group: Inc Ransom
• Country: United States
• Sector: Healthcare
• Announcement date: June 18, 2026

Inc Ransom claims massive data exfiltration from Horizon Family Medical Group

The threat actor known as Inc Ransom has announced a significant cyberattack targeting Horizon Family Medical Group. According to a post on a ransomware leak site, the group claims to have successfully breached the systems of the healthcare provider and exfiltrated a massive volume of data, totaling 7 terabytes. The announcement, made on June 18, 2026, suggests a high-impact breach involving sensitive information.

The group stated that they had already notified the management of Horizon Family Medical Group regarding the data loss. However, the threat actors claim that they have received no response from the organization following this notification. This lack of communication is a common occurrence in ransomware scenarios, where attackers often attempt to initiate negotiations through various channels after the initial breach is detected.

Details of the alleged data theft

The scope of the data allegedly stolen by Inc Ransom is extensive, covering both clinical and administrative domains. The group claims that the compromised information includes a wide array of sensitive records that could impact both the organization and its patients. The stolen data is reported to include patient visit histories, diagnoses, prescriptions, and laboratory results. Furthermore, the breach allegedly involves highly sensitive psychotherapy notes and women's health records.

Beyond clinical data, the attackers claim to have accessed critical operational and financial information. This includes allergy information, nutritional counseling data, and various financial and operational records stored within SQL and QuickBooks databases. The specific categories of affected data mentioned in the claim include:

• Patient medical records
• Psychotherapy notes
• Financial data
• Employee salary information
• Tax reports

The presence of such diverse data types suggests that the attackers gained significant access to the internal networks of the organization, moving beyond simple file access to deep integration with core business and medical databases.

About Horizon Family Medical Group

Horizon Family Medical Group is a healthcare provider operating in the Hudson Valley region of New York. The organization offers a comprehensive range of medical services, including primary care, women's health, behavioral health, and various other medical specialties. As a provider in the healthcare sector, the organization manages a vast amount of sensitive personal and medical information for its patient population.

Potential impact and industry implications

This breach, as claimed by Inc Ransom, poses a high risk to patient privacy. The exposure of medical histories, psychotherapy notes, and diagnoses can lead to severe consequences for individuals, including the potential for secondary attacks such as identity theft. In the healthcare sector, such incidents often trigger significant regulatory scrutiny. Organizations in this field may face legal sanctions under strict regulations like the Health Insurance Portability and Accountability Act (HIPAA), which is designed to protect sensitive patient health information.

Furthermore, the exposure of financial data, including tax reports and employee salary information, could cause the organization to lose its competitive advantage and lead to significant disruptions in its operational processes. The nature of the threat also highlights the use of double-extortion tactics. In these scenarios, attackers do not just encrypt systems to demand a ransom for decryption; they also threaten to publish the stolen data on public leak sites to pressure the victim into paying. Given this tactic, the risk of the stolen data being published in the future remains a distinct possibility.

To defend against such threats, organizations in the healthcare sector typically focus on implementing robust security frameworks. This includes maintaining strict access controls, implementing multi-factor authentication, and ensuring continuous monitoring of network traffic to detect unauthorized data movement. Regular audits of database security and encryption of data at rest and in transit are also critical defensive steps to mitigate the impact of potential exfiltration events.