Aerodiagnostics Listed by INC Ransom Ransomware Group

Aerodiagnostics, LLC, a Massachusetts laboratory that performs diagnostic breath tests for gastrointestinal conditions, has been listed on the leak site of the incransom ransomware group. The company confirmed that attackers exfiltrated roughly 50GB of internal files containing client data, confidential documents, NDAs, financial records, operational information, corporate data, and business agreements.

What Public Reporting Shows

Public reporting indicates the incident occurred in early 2026. The incransom group added Aerodiagnostics to its public leak site on May 6, 2026, and began publishing samples of the stolen material. The exposed data includes sensitive patient-related records alongside standard business documents. No exact number of affected patients has been disclosed, but the volume and nature of the files suggest thousands of individuals could be impacted. The laboratory has not yet issued a public statement detailing the timeline of initial compromise or the specific systems that were breached.

Why This Matters for You and Your Family

If you or anyone in your household has ever used Aerodiagnostics for breath testing related to SIBO, fructose malabsorption, sucrose intolerance, or lactose intolerance, your personal information may now sit in a ransomware data dump. Medical test results, contact details, insurance information, and payment records are particularly sensitive because they can be used to commit identity theft, file fraudulent tax returns, or impersonate you with healthcare providers. For families, a single breach like this can expose both parents and children if shared addresses or family-linked accounts were included in the client database.

The Doxxing and Identity-Chain Risks

Credential leaks and internal documents from healthcare providers frequently serve as the starting point for larger doxxing campaigns. Attackers cross-reference leaked emails, phone numbers, and patient identifiers with data from other breaches, gaming platforms, and social media. This creates an identity chain that can lead to account takeovers on email, banking, or children’s gaming accounts. Once attackers link a parent’s medical record to a child’s Roblox or Discord username, the entire household becomes easier to target for harassment, extortion, or further fraud. Credential leaks like this one cascade into account takeovers and doxxing chains.

IncRansom Group’s Known Track Record

Public reporting attributes the attacks to the incransom ransomware group, which emerged in late 2024. The group has targeted mid-sized businesses across healthcare, manufacturing, and professional services. Its typical playbook involves initial access through phishing or exploited remote desktop protocols, followed by claimed exfiltration of sensitive files before encryption. The group then demands payment to prevent publication, using a leak site to pressure victims with partial data dumps and countdown timers. While not as large as some older ransomware operations, incransom has shown a willingness to publish patient and client data when ransoms are not paid.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity so you can see exactly what chains back to the Aerodiagnostics breach.
• Rotate any password you ever used at Aerodiagnostics anywhere else it is reused, and switch on two-factor authentication through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information appears it is caught within hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts that often chain back to the same address or parent email.
• Let DoxxScan remediation specialists handle takedown requests for any exposed personal records found on data broker sites or paste services.

The Aerodiagnostics breach is a reminder that medical laboratories hold information just as valuable to criminals as banks do. Taking concrete steps now can limit how far attackers can travel down the identity chain that begins with this 50GB leak. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Start your DoxxScan trial today to understand your exposure and begin closing the gaps.