Inc Ransom ransomware group lists MENTAL HEALTH on its leak site

• Ransomware group: Inc Ransom
• Country: United States
• Sector: Healthcare
• Announcement date: April 14, 2025

Inc Ransom claims to have stolen data from Clinica Family Health

The Inc Ransom group has listed Clinica Family Health on its dedicated leak site, claiming to have successfully targeted the healthcare provider. According to the group's announcement, they have exfiltrated a significant amount of data belonging to the institution. The group has asserted that they possess more than 1 terabyte of the organization's information and has threatened to publish all of the stolen data if their ransom demands are not met.

Ransomware groups often utilize leak sites to exert pressure on their victims through a tactic known as double extortion. In this scenario, attackers do not just encrypt an organization's systems to disrupt operations; they also steal sensitive data to use as leverage. By threatening to release private information publicly, the threat actors aim to force a payment by leveraging the potential legal, regulatory, and reputational damage that a public data leak would cause to the victim organization.

Details of the alleged data theft

The information allegedly stolen by the Inc Ransom group is highly sensitive, given the nature of the victim organization. Based on the claims made by the attackers, the stolen data includes a wide variety of documents and records. The group has provided screenshots as evidence, which reportedly display previews of various file directories and different types of documents to support their claims.

The specific types of data mentioned in the listing include:

• Patient personal cards
• Treatment results
• Diagnosis data
• Postal correspondence
• Financial documents

The presence of such diverse data types suggests a deep intrusion into the organization's digital environment, potentially touching upon both administrative and clinical systems.

About Clinica Family Health & Wellness

Clinica Family Health & Wellness is a healthcare provider that offers integrated, whole-person care by combining physical, oral, and mental health services. The organization focuses on providing comprehensive care to support the overall well-being of its patients through a holistic approach to medical services.

Impact and risks of the incident

The potential publication of the alleged data poses significant risks to both the institution and the patients involved. Because the data is related to healthcare, the incident could lead to serious compliance issues under strict regulations such as HIPAA. The sensitive nature of medical records means that if this data is released, patients could face increased risks of identity theft or become targets for highly specific, targeted phishing attacks.

Furthermore, the organization may face negative impacts regarding its operational processes and its reputation management. The Inc Ransom group, which has been known to be active since mid-2023, represents a growing threat in the cyber landscape. Such leaks can also create cascading risks for the supply chain, as interconnected services and partners may be affected by the breach of a primary provider.

For organizations operating in the healthcare sector, maintaining robust defensive postures is critical. This typically involves implementing multi-factor authentication, maintaining rigorous patch management schedules, and ensuring that data encryption is applied to both data at rest and data in transit. Additionally, regular security awareness training for staff and comprehensive incident response plans are essential components of a modern cybersecurity strategy to mitigate the impact of such sophisticated extortion attempts.