Livability Listed by incransom Ransomware Group

Livability, the UK charity supporting people with disabilities, appeared on the leak site of the incransom ransomware group on 3 November 2023. The listing states that internal files were exfiltrated during a ransomware attack. The number of records affected remains unknown, and the precise data types have not been detailed beyond the broad description of internal files.

Primary Disclosure Details

The incransom leak site listing states that Livability was hit by a ransomware operation and that attackers successfully exfiltrated internal files. No specific volume of data or list of exposed record types is provided in the posting. The disclosure does not state whether customer, donor, employee, or beneficiary information was taken, nor does it mention any ransom demand or negotiation status. Public reporting on similar incransom postings indicates the group follows a double-extortion model: encrypting systems where possible and threatening to publish stolen data if payment is not made.

Why This Matters for You and Your Family

When a charity like Livability suffers a breach, the people it serves often have heightened vulnerability. Supporters, volunteers, donors, and individuals with disabilities or their families may have shared personal details during fundraising, event registration, or support requests. Even without exact figures, the exposure of internal files means names, addresses, contact information, or financial details could be circulating in criminal circles. For ordinary families, this translates into elevated risk of identity theft, phishing campaigns tailored to your connection with the charity, or fraudulent requests that appear to come from an organisation you trust.

Doxxing and Identity-Chain Risks

Credential leaks and internal documents from charities frequently serve as the starting point for doxxing chains. An email address or phone number taken here can be correlated with gaming accounts, social-media handles, or family-member records found in other breaches. Attackers then build a full profile that links your real identity to online activity. This is especially concerning for households with children or teenagers who use the same email for both charity-related logins and gaming platforms. Once one account is compromised, lateral movement to others becomes straightforward, leading to account takeovers, harassment, or further extortion.

Incransom Group Track Record

Public reporting attributes the emergence of incransom to mid-2023. The group has targeted organisations across multiple sectors, with previous victims including healthcare providers, educational institutions, and non-profits. Their typical playbook begins with initial access gained through phishing or exploitation of remote desktop services, followed by exfiltration of sensitive files before deploying ransomware. The extortion style relies on pressure through both encryption and the public leak-site threat, with deadlines often set for a matter of days after the initial posting. The incransom leak site continues to list new victims on a regular basis, indicating the operation remains active.

What to do

• Run a DoxxScan to map every link between your email addresses, phone numbers, handles, and real-world identity, then use the cleanup of Warden to remove what you can.
• Rotate any password you used on Livability.org or related services anywhere else it appears, and switch to 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information surfaces you are alerted within hours instead of months.
• Cover the entire household with DoxxScan family protection, which extends to dependents and children's gaming accounts that often chain back to the same addresses or parent emails.
• Let DoxxScan remediation specialists manage takedown requests for any exposed personal records found on data-broker and leak sites.

The incident underscores that even organisations whose mission is to remove barriers can inadvertently create new ones when their internal data reaches criminal forums. Staying ahead requires more than reactive checks. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and over 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with full household coverage that includes children’s gaming accounts where credential leaks commonly cascade into takeovers and doxxing. One practical step today can limit the long-term impact of breaches like this one.