OnePoint Patient Care Listed by incransom Ransomware Group

On August 6, 2024, OnePoint Patient Care appeared on the leak site operated by the incransom ransomware group. The Arizona-based hospice pharmacy, which provides medication delivery, mail-order services, and pharmacy benefit management nationwide, is claimed to have had internal files exfiltrated during a ransomware attack. The listing does not specify the number of people affected or detail the exact records taken.

Details from the Leak-Site Listing

The incransom leak site states that OnePoint Patient Care suffered a ransomware incident and that attackers successfully exfiltrated internal files. No sample data has been published, and the posting does not quantify how many patient records, employee documents, or other materials were removed. The disclosure indicates the company was given a deadline to negotiate or face full publication of the stolen material. Public details remain limited because the primary source—the onion-site posting—focuses on proof of compromise rather than a full inventory of the data.

OnePoint Patient Care, founded in 1965 and headquartered in Tempe, Arizona, delivers specialized pharmacy services to hospice patients across the United States. Any records taken would likely include sensitive health information, personal identifiers, and operational documents that attackers could use for extortion.

Why This Matters for You and Your Family

If you or a family member have received hospice medications, used OnePoint’s mail-order pharmacy, or been covered under their pharmacy benefit management services, your protected health information may now sit in an attacker’s archive. Health data carries lifelong consequences: it can be sold on underground markets, used to file fraudulent insurance claims, or combined with other stolen records to build convincing profiles for identity theft. Unlike a credit-card number, medical histories cannot be changed. Families dealing with end-of-life care are already under stress; discovering that personal medical details have been stolen adds another layer of vulnerability at a difficult time.

Doxxing and Identity-Chain Risks

Stolen internal files often contain more than clinical notes. They can include patient addresses, phone numbers, dates of birth, Social Security numbers, insurance details, and email correspondence. Attackers routinely chain these elements with username and password pairs from other breaches to take over online accounts. A hospice patient’s record that lists a home address can quickly link to family members living at the same location. Children’s gaming accounts that reuse an exposed email or password become entry points for further harassment and doxxing. Once an identity chain begins, it is difficult to stop without deliberate, ongoing effort.

Incransom’s Known Track Record

Public reporting attributes incransom with emerging in late 2023 as a ransomware-as-a-service operation. The group typically gains initial access through phishing, remote desktop protocol weaknesses, or compromised credentials. After exfiltrating data, they deploy encryption and then pressure victims through a dual-extortion model: threatening both to lock the victim’s systems and to publish sensitive files. Notable prior targets have included healthcare providers and mid-sized service companies where patient or customer data increases leverage. The group’s leak site follows a standard countdown format, giving victims a short window to pay before samples or full datasets are released. Exact success rates and total victims remain unclear, but healthcare organizations appear repeatedly in their listings.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real-world identity so you can see exactly what chains back to the OnePoint Patient Care breach.
• Rotate any password you used at OnePoint Patient Care or related pharmacy portals anywhere it has been reused, and switch to 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces within hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often become targets when credential leaks cascade into account takeovers and doxxing chains.
• Let remediation specialists handle data-broker takedown requests and opt-out processes that would otherwise consume weeks of your time.

The breach of OnePoint Patient Care shows how quickly healthcare supply-chain providers can expose the sensitive details families expect to remain private. Acting promptly on credential hygiene and identity mapping limits how far attackers can travel down the chain. DoxxScan by GalaxyWarden delivers that continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage including children’s gaming accounts. Start your DoxxScan trial today to close the gaps this incident has created.