Inc Ransom ransomware group lists bisonfamilymedical.com on its leak site

• Ransomware group: Inc Ransom
• Country: Canada
• Sector: Healthcare
• Announcement date: December 3, 2025

The Inc Ransom group has officially listed Bison Family Medical Clinics on its dedicated leak site. According to an announcement published by the threat actor group on December 3, 2025, the Canadian healthcare provider has been targeted in a cyberattack. The group claims to have successfully compromised a significant volume of data belonging to the organization.

Details of the alleged attack

The incident involves a claim made by the Inc Ransom group, which published its announcement through its own leak portal. The group asserts that the attack took place on November 3, 2025. In their public statement, the attackers claim that approximately 44 GB of data has been exfiltrated from the institution's systems.

Ransomware groups often utilize leak sites to increase pressure on their victims. These platforms serve as a public gallery where stolen data or notices of impending publication are displayed. This tactic is a central component of modern cyber extortion, where the threat of public exposure is used as leverage to compel organizations into paying a ransom. While the group has made these claims, the specific details regarding the nature of the breach remain limited to the information provided on their portal.

Data involved in the claim

Regarding the specific content of the allegedly stolen information, the group has not provided any specific details. The listing names no specific data types or individual files that have been compromised.

However, given the nature of the institution's operations, there is a possibility that the compromised data could include patient records or personal health information. In the healthcare sector, such data is highly sensitive and highly valued on illicit markets. The potential exposure of such information poses significant risks to patient privacy and data security. Furthermore, there is a possibility that the leaked data could be utilized for identity theft or targeted phishing attacks against the organization or its clients.

Organization profile

Bison Family Medical Clinics is a healthcare provider based in Winnipeg, Canada. The organization offers a variety of medical services across four different locations. Their medical offerings include family practice and walk-in services, as well as specialized services such as women's health, minor procedures, and low-risk obstetrics.

Impact and security implications

The alleged leak by the Inc Ransom group may pose substantial risks to the institution's patient privacy and data security. Because the organization operates within Canada, a potential data breach of this nature could trigger legal obligations under the Personal Information Protection and Electronic Documents Act (PIPEDA). This act governs how private-sector organizations handle personal information, and breaches often necessitate formal reporting and compliance measures.

The group involved, Inc Ransom, has been known to be active since 2023 and has targeted numerous institutions using similar methods. They are known to employ double-extortion tactics, a method where attackers not only encrypt an organization's data but also steal it, threatening to publish the sensitive information if the ransom is not met. This dual approach significantly increases the pressure on the victim, as the threat of a data leak remains even if the organization can restore its systems from backups.

For organizations operating in the healthcare sector, such incidents highlight the critical importance of robust cybersecurity frameworks. Common defensive steps for organizations include maintaining rigorous patch management, implementing multi-factor authentication across all access points, and conducting regular employee training to recognize phishing attempts. Additionally, maintaining offline, immutable backups and implementing strict data encryption protocols can help mitigate the impact of both encryption-based and exfiltration-based attacks. As threat actors continue to target sensitive sectors, maintaining high standards of data governance and incident response readiness remains essential for protecting sensitive information and maintaining public trust.