MENTAL HEALTH Listed by incransom Ransomware Group

On April 14, 2025, the ransomware group Incransom added Mental Health Partners — now operating as Clinica Family Health & Wellness — to its public leak site and claimed to hold more than 1 terabyte of the organization’s internal files containing personal data.

Reported Details from Reporting

Public reporting indicates the Colorado-based provider of integrated physical, oral, and mental health services was hit by a ransomware attack. The Incransom leak page states the group exfiltrated more than one terabyte of company data, including files described as containing personal information. No exact victim count has been released, and the precise types of records remain unclear beyond the broad category of internal files. The disclosure appeared on the group’s onion site, which is tracked by ransomware monitoring services such as ransomware.live.

Why This Matters for You and Your Family

When a healthcare provider’s systems are breached, the information exposed often includes names, addresses, dates of birth, Social Security numbers, medical histories, insurance details, and treatment records. These details are valuable to identity thieves because they allow criminals to file fraudulent tax returns, open accounts in your name, or impersonate you during medical visits. For families, a single breach can affect every member who has ever received care — including children whose records may contain future Social Security numbers or school-related health forms. Once stolen, this data can circulate for years on underground markets, increasing the chance that someone in your household will face account takeovers, unexpected bills, or credit damage.

The Doxxing and Identity-Chain Risk

Credential leaks from healthcare environments frequently cascade far beyond the original breach. An email and password pair stolen here can unlock personal accounts on other sites where the same credentials were reused. Attackers then link those accounts to gaming handles, social media profiles, and home addresses, building a complete identity chain. Public reporting shows these chains often lead to doxxing, swatting, or targeted harassment. Gaming accounts belonging to children are especially vulnerable because they frequently share the same email address or password as a parent’s healthcare portal, turning one medical breach into a household-wide exposure.

Incransom’s Publicly Known Track Record

Public reporting attributes Incransom with emerging in late 2024 as a ransomware operation that combines data theft with extortion. The group typically gains initial access through phishing or exploited remote desktop protocols, exfiltrates sensitive files before deploying encryption, and then posts samples on its leak site to pressure victims. Notable prior targets have included smaller healthcare providers and municipal organizations. Its playbook relies on public shaming: samples are published, followed by deadlines for payment, after which larger data dumps are threatened or released. Exact success rates are difficult to verify, but the group maintains an active presence on dark-web leak portals.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity so you can see exactly what this claimed breach connects to.
• Rotate the password you used for any Clinica Family Health & Wellness patient portal anywhere it has been reused, and switch to 2FA through an authenticator app instead of text messages.
• Enable continuous DoxxScan monitoring across 13.1 billion+ breach records and more than 100 platforms so the next leak exposing your family is caught in hours rather than months.
• Cover the entire household with DoxxScan family protection, which includes children’s gaming accounts that often chain back to the same addresses and credentials.
• Let remediation specialists handle takedown requests across data brokers and leak sites while you focus on securing your own accounts.

The incident is a reminder that healthcare data breaches continue to expose ordinary families to long-term identity and privacy risks. Taking concrete steps now limits how far attackers can travel down the identity chain. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and 100-plus platforms, AI-powered identity-chain mapping that connects online handles to real identities, and hands-on remediation by specialists who manage takedowns for you and your entire household, including children’s gaming accounts.