tricountyhs.org Listed by INC Ransom Ransomware Group

On July 1, 2026, the ransomware group Incransom added tricountyhs.org to its public leak site, claiming that it had exfiltrated internal files from Flowers Early Learning, the nonprofit formerly known as Tri-County Head Start that serves families across Berrien, Cass, and Van Buren counties in Southwest Michigan.

What Public Reporting Shows

Public reporting indicates the organization suffered a ransomware attack in which attackers gained access to internal systems and removed files before encrypting data. The nonprofit provides federally funded early childhood education and family support services for children from birth to age five and expectant mothers. No exact number of affected individuals has been disclosed, and the precise volume or content of the stolen files remains unclear from available reporting. The listing appeared on the Incransom leak site with a disclosure reference tied to the domain tricountyhs.org.

Why This Matters for You and Your Family

When a local nonprofit that handles enrollment forms, health records, family addresses, and contact details for young children is breached, the information can directly affect the families it serves. Internal files often contain names, dates of birth, addresses, phone numbers, and sometimes Social Security numbers for both parents and children. Once that data leaves the organization’s control, it can be sold, traded, or used to target you with identity theft, phishing, or harassment. For families with young children, the exposure creates long-term risk because a child’s records stay valuable to criminals for decades.

The Doxxing and Identity-Chain Implications

Leaked internal files frequently link an email address or phone number to a child’s name, parent’s employer, home address, and even details about daily routines. Attackers and data brokers can chain these fragments together with information from other breaches to build a complete profile. A single credential leak from this incident can cascade into gaming account takeovers if children use the same email or password on Roblox, Minecraft, or other platforms. Those compromised game accounts then become entry points for further doxxing, harassment, or social engineering against the entire household.