Vnakc.org Listed by IMNCrew Ransomware Group

On May 5, 2025, the ransomware group IMNCrew added VNA Home Health to its public leak site, claiming that internal files had been exfiltrated from the 134-year-old Kansas City nonprofit home health agency.

What's Publicly Reported from Reporting

Public reporting indicates that VNA Home Health, formally known as Visiting Nurse Association, serves patients across the Kansas City area with in-home nursing, therapy, and related care. The organization traces its founding to 1891 and describes itself as the sixth-oldest home health agency in the United States.

Available reporting describes the incident as a ransomware attack in which attackers gained access to internal systems, exfiltrated files, and later listed the victim on their dark-web leak portal. The exact number of individuals whose records were taken remains unknown. No specific deadline for ransom payment has been publicly detailed in available sources.

The primary source for the listing is the IMNCrew leak site itself, indexed by ransomware-tracking platforms such as ransomware.live.

Why This Matters for You and Your Family

When a home health provider is breached, the files taken often contain names, addresses, dates of birth, Social Security numbers, medical histories, insurance details, and contact information for patients and their family caregivers. If you or someone you care for has used VNA Home Health services in the Kansas City region at any point in the past decade, your family’s sensitive health and financial data may now sit on a criminal data marketplace.

Medical and financial records are especially dangerous because they allow criminals to file fraudulent tax returns, open accounts in your name, or impersonate you during medical visits. A single breach like this can expose multiple generations when adult children help coordinate care for aging parents.

The Doxxing and Identity-Chain Risks

Stolen internal files frequently include email addresses, phone numbers, and notes that link family members together. Attackers can combine this information with data from previous breaches to build detailed profiles. A phone number tied to a parent’s record can lead to a child’s gaming username; that username can reveal a school or neighborhood; the chain continues until full doxxing becomes possible.

Credential leaks like this one cascade into account takeovers on personal email, banking, and gaming platforms. Children’s gaming accounts are particularly vulnerable because kids often reuse passwords or email addresses that appear in family medical files. Once an attacker controls one account in the household, they can reset others and demand payment to stop further exposure.

IMNCrew’s Publicly Known Track Record

Public reporting attributes the group’s emergence to 2024. IMNCrew has listed healthcare providers, local governments, and small-to-medium businesses. Their typical playbook involves initial access through phishing or exploited remote desktop services, followed by data exfiltration and encryption. They then pressure victims with a dual extortion tactic: threatening to publish stolen files on their leak site while also demanding payment to restore encrypted systems.

Available reporting describes IMNCrew as relatively new compared with older ransomware operations, yet aggressive in naming victims quickly when ransom demands are ignored.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity so you can see exactly what this claimed breach connects to.
• Rotate any password you have ever used at VNA Home Health or similar health providers, then enable two-factor authentication through an authenticator app on every account where that password was reused.
• Enable continuous DoxxScan monitoring across 13.1 billion+ breach records and more than 100 platforms so the next exposure of your family’s data is caught within hours rather than months.
• Cover the entire household with DoxxScan family protection, which extends to dependents and children’s gaming accounts that often chain back to the same addresses and emails appearing in medical files.
• Let remediation specialists handle takedown requests across data brokers and leak sites so you do not have to negotiate directly with threat actors or spend weeks chasing removal requests yourself.

The speed with which ransomware groups publish stolen healthcare data shows that waiting for notification letters is no longer enough. Start your DoxxScan trial today and put continuous monitoring, identity-chain mapping, and hands-on remediation specialists between your family and the next breach. DoxxScan by GalaxyWarden is built precisely for situations like this, giving ordinary families the same early-warning and cleanup capabilities once reserved for large organizations.