Onecare Listed by incransom Ransomware Group

On December 15, 2024, One Care Home & Community Support Services appeared on the leak site operated by the incransom ransomware group. The nonprofit organization, which delivers in-home supportive care to seniors and people with disabilities in Huron and Perth Counties and surrounding areas in Ontario, is claimed to have had internal files exfiltrated during a ransomware attack. The exact number of individuals affected remains unknown, as neither the leak-site listing nor any official notification has quantified impacted records.

Details from the Primary Listing

The incransom leak site states that One Care suffered a ransomware incident in which attackers successfully exfiltrated internal files. The disclosure does not specify the volume or exact categories of data taken, only that the material was obtained during the ransomware deployment. As of the listing date, the group had not publicly posted samples of the stolen data, a common tactic used to pressure victims into payment. The primary source listing also does not disclose any ransom demand amount or negotiation status.

Why This Matters for You and Your Family

If you or someone in your family has received care from One Care, your personal information may have been inside the compromised internal systems. Organizations providing home support services routinely hold names, addresses, dates of birth, health details, government identifiers, and contact information for both clients and their family members. When such records are taken in a ransomware event, the exposure can affect multiple generations within the same household. Even though the precise data types are not detailed in the listing, the nature of One Care’s work makes it likely that sensitive caregiving records were present.

Doxxing and Identity-Chain Risks

Stolen internal files from care providers often contain enough personal details to link an individual’s real identity to online handles, email addresses, phone numbers, and family relationships. Attackers or data resellers can combine this information with other breaches to build detailed profiles. These chains frequently lead to targeted phishing, account takeovers, and doxxing campaigns. Credential leaks of this kind also cascade into gaming accounts belonging to you or your children, where the same reused passwords or recovery emails can hand over control to strangers who then harass or further expose the household.

Incransom’s Known Track Record

Public reporting attributes incransom with emerging in late 2023 as a ransomware-as-a-service operation. The group has targeted healthcare, education, and nonprofit entities in North America and Europe. Their typical playbook involves initial access through phishing or exploited remote desktop services, followed by exfiltration of sensitive files before encryption. After deployment, they wait a short period before listing victims on their leak site, using the threat of public data release to encourage payment. The exact success rate of their extortion attempts is unclear, but healthcare-related victims appear frequently in their disclosures.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real identity, with cleanup of exposed records.
• Rotate any password you have used with One Care or related services anywhere it is reused, and switch to 2FA through an authenticator app rather than text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours instead of months.
• Cover the entire household with DoxxScan family protection, which extends to dependents and children’s gaming accounts that often chain back to the same address or recovery details.
• Let remediation specialists handle data-broker takedown requests and ongoing exposure cleanup on your behalf.

The incident underscores how quickly caregiving organizations can become targets and how rapidly stolen records can fuel broader identity abuse. One short forward-looking step is to treat every care-provider relationship as a potential data exposure point and act before criminals connect the dots. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts.