Inner City Family Health Team (ICFHT.local) Listed by incransom Ransomware Group

On December 23, 2024, the Inner City Family Health Team in Toronto appeared on the leak site of the incransom ransomware group. The organization, which delivers primary care to homeless and previously homeless individuals, had internal files exfiltrated during a ransomware attack. While the exact number of people whose information was taken remains unknown, any patient, employee, or vendor whose records passed through the clinic could be affected.

What Public Reporting Shows

Public reporting indicates that incransom listed ICFHT.local on its disclosure page and claimed to have downloaded internal files before encrypting systems. The data exposed consists of internal files rather than a single structured database. No sample files have been publicly released at the time of writing, and the precise volume or sensitivity of the material has not been independently verified. The incident follows the group’s typical pattern of posting victims after an initial extortion window expires.

Why This Matters for You and Your Family

If you or anyone in your household has ever received care at Inner City Family Health Team, your personal health information, contact details, or administrative records may now sit on a ransomware leak site. Health records are especially damaging when leaked because they can reveal addresses, phone numbers, dates of birth, and medical conditions that criminals can use for identity theft, insurance fraud, or targeted harassment. Even if your name is not on the initial list, family members linked through shared addresses or phone numbers can quickly become part of the same exposure chain.

The Doxxing and Identity-Chain Implications

Ransomware leaks rarely stop at one dataset. A single exposed email or phone number can be cross-referenced with gaming accounts, social-media handles, and data-broker profiles to build a complete picture of your household. Public reporting shows these chains often lead to doxxing, where attackers publish home addresses, children’s names, or school information. Credential leaks of this kind frequently cascade into account takeovers on gaming platforms, because the same password used for a clinic portal may also protect a child’s Roblox, Fortnite, or Discord account.

Incransom’s Publicly Known Track Record

Public reporting attributes the incransom group with emerging in mid-2024. The gang has listed healthcare providers, municipal governments, and small manufacturers among its victims. Its standard playbook involves initial access through phishing or unpatched remote desktop services, followed by exfiltration of internal documents, deployment of ransomware, and then dual extortion: demanding payment to decrypt systems and a second fee to prevent publication of stolen files. When victims do not pay, incransom posts proof-of-compromise screenshots and offers the data for sale or free download after a deadline.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity so you can see exactly what this claimed breach connects to.
• Rotate any password you ever used at Inner City Family Health Team and enable 2FA with an authenticator app everywhere that password was reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak that touches your family is caught in hours rather than months.
• Cover the household with DoxxScan family protection, which extends to dependents and children’s gaming accounts that often chain back to the same address or parent email.
• Let remediation specialists handle takedown requests across data brokers and leak sites so you do not have to negotiate with threat actors yourself.

The incident underscores that healthcare breaches now feed directly into broader identity theft and doxxing campaigns that can touch every member of a household. Starting with a clear map of your exposure and maintaining continuous oversight gives you the best chance of stopping the next stage before it begins. DoxxScan by GalaxyWarden delivers that continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that connects scattered handles to real identities, and hands-on remediation by specialists who manage takedowns for you, all with household coverage that includes children’s gaming accounts.