Inc Ransom ransomware group lists Hpital Glengarry Memorial Hospital (clglen.local) on its leak site

• Ransomware group: Inc Ransom
• Country: Canada
• Sector: Healthcare
• Announcement date: April 28, 2025

The threat actor known as Inc Ransom has listed Glengarry Memorial Hospital on its dedicated leak site. According to the group's announcement, the organization has been targeted in a cyberattack, with the group claiming to have successfully accessed the institution's internal systems and obtained various documents.

The claimed attack and incident details

The incident was officially announced on the Inc Ransom leak site on April 28, 2025. The group claims that they have gained unauthorized access to the hospital's systems, allowing them to extract a variety of documents. To support their claims, the threat actors have shared numerous visual proofs that allegedly relate to the ongoing operations of the hospital.

While the group has provided screenshots to demonstrate their access, the full scope and volume of the stolen data remain unclear. The provided imagery shows various documents, forms, and tables that appear to be linked to the administrative and operational processes of the institution. At this stage, there is no clear information regarding the total number of files or the specific size of the data exfiltrated during the breach.

Data types and affected information

Based on the information provided by the threat actor, the breach involves several categories of institutional information. The leaked content appears to include:

• Corporate documents
• Administrative forms
• Financial statements

The specific details regarding the exact contents of these documents are not fully disclosed, and no specific ransom demand has been made public by the group at this time.

About Glengarry Memorial Hospital

Glengarry Memorial Hospital is a community hospital located in the Alexandria area of Ontario. The facility serves the local community by providing a range of essential medical services, including emergency services, inpatient care, and various outpatient services.

Analysis and implications for the healthcare sector

This incident may represent a double-extortion case. In such scenarios, ransomware groups do not merely encrypt data to disrupt operations; they also steal sensitive information to use as leverage. By threatening to publish the data on a public leak site, the attackers aim to pressure the organization into paying a ransom to prevent the exposure of its sensitive information.

Because the institution operates within the healthcare sector, the exposure of sensitive data carries significant risks. If the breach includes personal health information or employee data, it could trigger legal processes and regulatory scrutiny under frameworks such as the Personal Information Protection and Electronic Documents Act (PIPEDA). The disclosure of such documents can lead to severe consequences for both the institution and the individuals whose information is involved.

Furthermore, the leaked documents might be utilized by the attackers for secondary purposes. This includes the potential for targeted phishing attempts against the institution's operational processes or other subsequent attacks. The presence of administrative and financial documents provides a roadmap that threat actors can use to craft more convincing social engineering campaigns.

For organizations in the healthcare sector, maintaining robust defensive measures is critical. This typically involves implementing strong access controls, continuous monitoring of network traffic, and ensuring that data is encrypted both at rest and in transit. Given the high value of medical and administrative data on the dark web, healthcare providers remain a primary target for sophisticated ransomware groups like Inc Ransom.