Horizon Family Medical Group Listed by incransom Ransomware Group

On June 18, 2026, the incransom ransomware group listed Horizon Family Medical Group on its leak site and claimed to have stolen 7 terabytes of internal data, including 1 TB of files and 6 TB of SQL and QuickBooks databases containing patient records and financial information.

Confirmed Details from Reporting

Public reporting indicates the group posted screenshots and a summary claiming full access to Horizon’s digital footprint. The exposed material reportedly includes patient records, internal documents, and financial databases. The exact number of patients or individuals affected remains unknown, as neither the medical group nor the ransomware operators have released a full victim count. Available reporting describes the data as a combination of structured databases and unstructured files totaling seven terabytes.

The incident follows the group’s typical pattern of exfiltrating data before encrypting systems and later threatening public release unless a ransom is paid. No independent verification of the full dataset has been published, but the listing itself on the incransom leak site confirms the organization has been targeted.

Why This Matters for You and Your Family

When a medical provider’s systems are breached, the information at risk is deeply personal. Medical histories, addresses, dates of birth, Social Security numbers, insurance details, and payment records can all appear in a single leak. For you and your family, that means a higher chance of identity theft, insurance fraud, or targeted scams that use real health information to sound legitimate.

Patient records and financial databases are especially damaging because they link your name to sensitive conditions, treatments, and bank accounts. Once that combination is loose on the dark web, it rarely disappears. Families who use the same passwords across personal and health-related logins face immediate risk of account takeovers that spread far beyond the original breach.

The Doxxing and Identity-Chain Risk

Credential leaks from healthcare organizations often cascade into doxxing chains. An email and password stolen from a medical portal can unlock personal accounts, social media, and even children’s gaming profiles that share the same household details. Attackers map these connections to build complete identity profiles that include home addresses, phone numbers, and family relationships.

This is why continuous monitoring across large breach repositories matters. DoxxScan by GalaxyWarden tracks exposures across 15.4 billion breach records and more than 100 platforms, using AI-powered identity-chain mapping to link handles, emails, and real-world identities. Its specialists also provide hands-on remediation, and its household coverage extends to children’s gaming accounts that frequently become entry points for further harassment or extortion.

Incransom’s Publicly Known Track Record

Public reporting attributes incransom with emerging in late 2024 or early 2025. The group has targeted healthcare providers, municipalities, and mid-sized businesses. Its playbook typically involves initial access through phishing or exploited remote desktop services, followed by exfiltration of sensitive databases before encryption. The extortion style combines data leaks on dedicated onion sites with direct pressure on victims through email and phone contact. Notable prior victims include other healthcare organizations whose patient data appeared in similar multi-terabyte dumps.

What to do

• Run a DoxxScan to map every link between your emails, phones, usernames, and real identity, then use the no-subscription cleanup of Warden to remove what you can.
• Rotate the password used at Horizon Family Medical Group anywhere it is reused, and switch on 2FA through an authenticator app rather than text messages.
• Enable continuous DoxxScan monitoring so the next breach that touches your family is caught in hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts tied to the same address or credentials.
• Let remediation specialists handle takedown requests across data brokers and leak sites on your behalf.

The Horizon breach is a reminder that healthcare data rarely stays contained once it leaves protected systems. Taking concrete steps now limits how far the stolen information can travel. Start your DoxxScan trial and let its continuous monitoring, identity-chain mapping, hands-on specialists, and family coverage work for every member of your household, including gaming accounts that often chain back to the same personal details.