The Loretto Hospital listed on Inc Ransom leak site

• Ransomware group: Inc Ransom
• Country: United States
• Sector: Healthcare
• Announcement date: April 1, 2025

Inc Ransom claims data breach at The Loretto Hospital

The ransomware group known as Inc Ransom has officially listed The Loretto Hospital on its dedicated leak site. According to the group's announcement, the cyberattack and subsequent data publication occurred on April 1, 2025. This development follows a pattern of double-extortion tactics, where threat actors not only encrypt an organization's systems but also steal sensitive information to use as leverage during ransom negotiations.

The group alleges that they have successfully exfiltrated various documents and identification images from the institution. This type of announcement is a common method used by ransomware operators to increase psychological and financial pressure on a target organization. By publicly displaying samples of stolen data, the group aims to demonstrate the validity of their breach and force the victim into compliance with their demands.

Details of the alleged data theft

While the specific volume of data and the exact number of files involved have not been disclosed by the group, the leaked content appears to be significant in nature. The group has shared screenshots and samples that purportedly contain sensitive information belonging to the institution's stakeholders. Based on the available evidence provided by the attackers, the stolen data is assessed to potentially belong to hospital staff or patients.

The specific categories of data identified in the leak include:

• Identification documents
• Medical records
• Corporate documents

The presence of such diverse data types—ranging from personal identification to private medical history—highlights the high-stakes nature of attacks targeting healthcare providers. Such breaches often involve a mix of personally identifiable information (PII) and protected health information (PHI), both of which are highly valuable on illicit markets.

About The Loretto Hospital

The Loretto Hospital is a healthcare provider based in the United States, specifically serving the Austin community in Chicago. Established in 1923, the institution has a long history of providing medical services to its local community. The hospital offers a wide variety of medical services, including primary care, geriatrics, women's health, and dental care.

Implications and risks for the healthcare sector

This action by the Inc Ransom group highlights the ongoing risks regarding the exposure of sensitive data within the healthcare sector. Because the patient data held by medical institutions is subject to strict protection under regulations such as HIPAA, any confirmed breach can lead to significant legal and administrative sanctions. Beyond the regulatory consequences, the exposure of medical and identity data poses a direct threat to individuals, potentially leaving them vulnerable to identity theft or highly targeted phishing attacks.

The group's use of the double-extortion method can have a devastating impact on an institution's operational continuity and its overall reputation. When patient trust is compromised, the long-term effects on a healthcare provider can be profound. Inc Ransom, which emerged in mid-2023, is known for its methodology of infiltrating corporate networks and employing a combination of data encryption and exfiltration tactics to maximize their leverage.

To mitigate these types of threats, organizations in the healthcare sector typically focus on robust defensive measures. These include implementing strict access controls, maintaining comprehensive logging and monitoring to detect unauthorized movement within a network, and ensuring that all sensitive data is encrypted both at rest and in transit. Furthermore, regular security awareness training for staff is essential to prevent initial entry through common vectors like phishing. As ransomware groups continue to evolve their tactics, the necessity for a multi-layered defense strategy remains a critical priority for healthcare administrators and IT security teams alike.