The Kingdom of Tonga's Ministry of Health listed by incransom

• Ransomware group: incransom
• Country: Tonga
• Sector: Government & Defense
• Announcement date: June 27, 2025

The incransom ransomware group has listed The Kingdom of Tonga's Ministry of Health on its leak site. According to the announcement published on June 27, 2025, the threat actor claims to have successfully compromised the systems of the institution and gained access to its data.

The alleged attack and claims by incransom

The threat actor known as incransom has made a public claim regarding a breach involving The Kingdom of Tonga's Ministry of Health. The group alleges that it has gained unauthorized access to the institution's internal systems. This announcement was officially posted on the group's leak site on June 27, 2025, following the claimed attack date of June 26, 2025.

Ransomware groups typically use leak sites to apply pressure on their victims. These sites serve as a public gallery where the group posts names of targeted organizations to increase visibility and coerce the victim into paying a ransom. In many modern cyberattacks, threat actors employ a method known as double extortion. In this scenario, the attackers do not just encrypt the victim's files to disrupt operations; they also exfiltrate sensitive data before the encryption occurs. The threat of leaking this stolen information on a public forum provides the attackers with additional leverage during negotiations.

Details regarding the alleged data breach

At this time, there is no information regarding the specific nature of the alleged leaked data. The listing does not specify the types of files that may have been accessed, nor has any screenshot been provided by the group to substantiate their claims. Furthermore, the group has not disclosed the total size of the data or the specific file count involved in the incident.

• No specific data types were named in the listing.

The organization profile

The Kingdom of Tonga's Ministry of Health is the government body responsible for managing the country's central hospitals, health centers, and community-based health services. The ministry is tasked with addressing non-communicable diseases, such as diabetes, obesity, and heart disease, while also being responsible for providing essential healthcare services to the population.

Potential risks and sector implications

This incident may pose a significant risk of exposing sensitive health data within the institution. The publication of such data could lead to identity theft or targeted phishing attacks against both employees and the citizens who receive services from the ministry. Additionally, a breach of public health data might cause significant disruptions in the institution's operational processes.

Given the double-extortion method utilized by the incransom group, it is possible that the institution may face ransom demands. Publicly available information regarding the specific capabilities and history of this group remains limited in the public domain.

For organizations operating within the government and healthcare sectors, such incidents highlight the critical importance of robust cybersecurity frameworks. Protecting sensitive personal and health information requires a multi-layered defense strategy. Common defensive steps for such organizations include implementing strict access controls, maintaining regular offline backups, and conducting continuous monitoring of network traffic to detect unauthorized access. Furthermore, regular security awareness training for employees can help mitigate the risk of initial entry via phishing, which is a common vector for ransomware deployment.