Kannarr Eye Care Listed by incransom Ransomware Group

On April 10, 2026, Kannarr Eye Care in Pittsburg, Kansas, appeared on the leak site of the incransom ransomware group. The clinic, which provides eye exams, contact lens fittings, cataract surgery, and treatment for ocular diseases to patients across a four-state area, had internal files exfiltrated during a ransomware attack. Public reporting indicates that patient and employee information may have been among the stolen data, though the exact number of affected individuals remains unknown.

What's Publicly Reported from Reporting

Available reporting describes the incident as a classic ransomware operation in which attackers gained access to Kannarr Eye Care’s systems, encrypted data, and then exfiltrated files before demanding payment. The incransom group published a sample of the stolen material on its dark-web leak site on April 10, 2026. No precise victim count has been released by the clinic or the attackers. The exposed information consists of internal files that likely contain names, addresses, dates of birth, insurance details, medical records, and possibly Social Security numbers for patients and staff.

Why This Matters for You and Your Family

When a local health-care provider like Kannarr Eye Care is breached, ordinary families lose control of sensitive personal and medical data. A single leak can give criminals the building blocks they need to open fraudulent accounts, file fake tax returns, or impersonate you with insurers. Because eye-care clinics serve entire households—including children who need vision screenings—the breach can expose multiple generations at once. Medical details are especially damaging: they can be used for blackmail, insurance fraud, or to craft more convincing phishing messages that reference your actual health history.

The Doxxing and Identity-Chain Implications

Stolen health-care files rarely stay isolated. Attackers routinely cross-reference names, addresses, phone numbers, and email addresses with credential leaks from other services. This creates an identity chain that links your doctor’s records to your online accounts, social-media handles, and even your children’s gaming profiles. Once the chain is built, opportunistic criminals can move from simple identity theft to full doxxing—publishing your home address, children’s names, and daily routines. Credential leaks like this one frequently cascade into account takeovers precisely because the same password used for a patient portal is often reused on email, banking, or gaming platforms.

Incransom’s Publicly Known Track Record

Public reporting attributes the attacks to the incransom ransomware group, which emerged in late 2024. The group has targeted hospitals, dental practices, and small medical clinics, typically following a double-extortion playbook: encrypt victim systems, exfiltrate sensitive files, then threaten both data publication and further ransomware deployment unless a ransom is paid. Notable prior victims include other regional health-care providers whose patient records appeared on the same leak site. The group’s public-facing blog posts usually set short payment deadlines—often seven to fourteen days—before releasing additional batches of stolen data.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, addresses, and online handles that may have surfaced in the Kannarr files.
• Rotate the password you used at Kannarr Eye Care anywhere it is reused and enable 2FA through an authenticator app rather than text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your information is caught in hours, not months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often become entry points for doxxing chains when parent credentials are leaked.
• Let remediation specialists handle takedown requests across data brokers and leak sites on your behalf while you focus on securing your own accounts.

The Kannarr Eye Care breach is a reminder that health-care providers of any size can become targets, and the data they hold travels farther and lasts longer than most families realize. Taking concrete steps now limits how far criminals can extend the identity chain. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Families who act quickly reduce the window attackers need to monetize stolen information.