Southern Alberta Community Living Association Listed by incransom Ransomware Group

On January 18, 2026, the Southern Alberta Community Living Association appeared on the leak site of the ransomware group known as incransom. The nonprofit organization, which supports individuals with disabilities through personalized services, is claimed to have had internal files exfiltrated during a ransomware attack. While the exact number of people whose information may have been exposed remains unknown, anyone who has received services from SACLA, shared personal details with them, or has a family member in their programs could be affected.

What's Publicly Reported from Reporting

Public reporting indicates that incransom listed SACLA on its disclosure page and claimed to have taken internal files. The association, founded in 1980, provides individualized supports aimed at helping people with disabilities achieve personal goals and build community connections. Available reporting describes the data as internal files, though specific types of records have not been detailed in initial disclosures. No confirmed victim count has been released, and the precise date of the initial breach has not been made public beyond the January 18 leak-site posting.

Why This Matters for You and Your Family

When a community organization like SACLA suffers a breach, the impact reaches ordinary families who trusted it with sensitive information. Internal files often contain names, addresses, dates of birth, medical or support details, and contact information for both the individuals receiving services and their family members. If your household has ever worked with SACLA, your data may now sit in a ransomware group’s hands, available to criminals who buy or trade it. This kind of exposure can lead to identity theft, targeted scams, or unwanted contact long after the initial incident fades from news headlines.

The Doxxing and Identity-Chain Risks

Ransomware leaks rarely stop at one organization. Criminals frequently use stolen internal files to map connections between names, emails, phone numbers, and online handles. These identity chains can reveal family relationships, children’s information, and even gaming accounts that reuse the same passwords or recovery emails. Once criminals link your real identity to an online handle, they can pursue doxxing, account takeovers, or extortion. Credential leaks like this one regularly cascade into gaming account compromises for both adults and children, turning a single breach into a chain of further exposures across social media, email, and gaming platforms.

Incransom’s Publicly Known Track Record

Public reporting attributes the group’s emergence to relatively recent ransomware activity. The incransom operation follows a typical double-extortion playbook: gaining initial access to a victim’s network, exfiltrating data before encryption, and then threatening to publish the stolen files unless a ransom is paid. Notable prior victims have included other small-to-medium organizations, though specific earlier targets are still being tracked by ransomware researchers. The group posts evidence on its leak site when victims do not meet payment deadlines, a pattern consistent with many contemporary ransomware operations.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real identity so you can see exactly what this claimed breach may have exposed.
• Rotate any password you ever used with SACLA and enable 2FA through an authenticator app on every account where that password was reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information appears it is caught within hours rather than months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same addresses or recovery details.
• Let remediation specialists handle takedown requests and notifications for you while you focus on securing your own accounts.

The incident shows how quickly an organization’s misfortune can become your family’s privacy problem. Taking concrete steps now limits how far the exposed data can travel. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with household coverage that includes children’s gaming accounts vulnerable to the kind of credential chaining seen in incidents like this. Start protecting what matters most before the next leak appears.