eclmn.com Listed by INC Ransom Ransomware Group

On July 28, 2026, the ransomware group Incransom publicly listed eclmn.com on its leak site, claiming the Minnesota-based family-run organization suffered a ransomware attack in which internal files were exfiltrated. The organization provides adapted housing, professional in-home support, and daily living solutions for adults with physical disabilities and limited mobility. As of this writing, eclmn.com has not issued a public confirmation or breach notification.

Leak Site Claim Details

The Incransom leak-site listing states that internal files were exfiltrated during a ransomware attack. The posting does not specify the volume or exact types of data taken, nor does it list any sample files. It also does not quantify how many individuals may be affected. Because the primary disclosure comes solely from the threat actor’s own leak site rather than a company statement, regulator filing, or federal agency notice, this remains an unconfirmed claim. The organization has not, as of writing, publicly acknowledged the incident or the validity of the group’s assertions.

Why This Matters for You and Your Family

When a care provider that handles adapted housing and in-home support for people with disabilities is targeted, the potential exposure of personal information is significant. Clients, their family members, caregivers, and employees often share sensitive details including names, addresses, medical conditions, support plans, and financial information related to care services. Even without exact numbers from the listing, any compromise of such records can place vulnerable adults and their households at heightened risk of identity theft, fraud, and targeted scams. If your family has used residential care, in-home assistance, or disability support services in Minnesota, your information could be among the records the group claims to hold.

Doxxing and Identity-Chain Risks

Ransomware actors increasingly use stolen internal files not only for extortion but to map relationships between individuals. A leaked client file can link a disabled adult’s name to family members, home addresses, phone numbers, email accounts, and even children’s gaming usernames that share the same household. These connections create doxxing chains: once an address or phone number surfaces, it can be cross-referenced across dozens of other breaches to build a complete identity profile. Credential leaks from care organizations are particularly dangerous because they often contain both work and personal contact details that cascade into account takeovers. Gaming accounts belonging to you or your children are frequently exposed through these household linkages, turning a single breach into long-term privacy and security headaches.

Incransom’s Known Track Record

Public reporting attributes Incransom with emerging in late 2024 as a ransomware-as-a-service operator. The group typically gains initial access through phishing, compromised remote desktop credentials, or exploited vulnerabilities in internet-facing systems. Once inside, they exfiltrate data before deploying ransomware and then follow a double-extortion model: demanding payment to prevent file encryption and a second payment to avoid publication of stolen documents. Notable prior victims have included small-to-medium healthcare and service organizations. The group maintains an active leak site where it posts victim names and, in many cases, samples of allegedly stolen data if ransom demands are not met.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real-world identity, then use the cleanup to begin removing exposed records.
• Enable continuous DoxxScan monitoring across 13.1 billion+ breach records and 100+ platforms so new exposures tied to this incident or future ones are flagged quickly.
• Rotate any passwords used at eclmn.com or related care-provider portals anywhere they are reused, and switch to 2FA using an authenticator app rather than SMS.
• Recognize that a leaked home address from a care provider file can expose everyone living there; your own timely data-removal requests are what ultimately reduce circulation of that address.
• Let remediation specialists handle takedown requests across data brokers and people-search sites on your behalf instead of attempting manual removal yourself.

The incident underscores how even organizations supporting vulnerable populations remain prime targets, and that individuals must treat every ransomware claim involving care providers as a prompt to secure their own digital footprint. Running DoxxScan’s continuous monitoring and identity-chain mapping, backed by hands-on remediation specialists, gives ordinary families a practical way to reduce the long-term impact of leaks like this one. Your own proactive steps today limit what criminals can do with data tomorrow.