Health Sciences Centre Data Breach

incransom listed Health Sciences Centre, a Canadian healthcare organization, on its leak site on 2026-10-11. The ransomware group has claimed 68 victims in the past 60 days, with a primary focus on the Manufacturing and Healthcare sectors. Geographic concentrations for incransom’s victims include the US, Canada, and Malaysia, with Canada specifically identified as a priority geography. The deliberate targeting of the healthcare sector is driven by the high extortion leverage associated with patient data and operational disruption, particularly under Canadian privacy laws like PHIPA. Healthcare organizations also face significant regulatory pressure to restore services quickly, making them more likely to pay ransoms. incransom’s recent activity indicates a consistent pattern of targeting critical infrastructure and sensitive data sectors. The group’s focus on Manufacturing and Healthcare, coupled with a strong presence in North America, positions them as a significant threat to organizations in these domains. The current victim, Health Sciences Centre, aligns with the group’s established targeting profile, suggesting a calculated approach rather than opportunistic attacks. The number of claimed victims over the past 60 days highlights incransom’s active and aggressive campaign, underscoring the need for vigilance within targeted industries and regions.

Stealer-log verdict: severe_exposure_in_sample. The analysis of a 24-record sample revealed significant credential exposure across organizational systems. This included 20 employee credentials on internal systems (Category A) and 4 external user accounts on organizational portals (Category B). The affected endpoints include the ADFS SSO portal, webmail, and internal health portals. The data within the log spans a 13-month period, from 2025 through 2026. The presence of Active Directory Federation Services (ADFS) as the central Single Sign-On (SSO) layer for most healthcare network environments is a critical finding. Compromise of ADFS can lead to credential access that propagates across connected clinical, administrative, and communication systems. The thirteen months of continuous ADFS exposure is a defining characteristic of this incident. Infected workstations likely operated undetected for over a year, and the stolen credentials were available in criminal markets throughout that window. incransom or an affiliate likely acquired this access through an Initial Access Broker (IAB) and used it to pre-position before the October 11 listing. The 20 Category A credentials, combined with ADFS access, indicate the potential for broad lateral movement within the healthcare network. Force credential rotation across all ADFS-federated accounts immediately. Audit ADFS authentication logs for anomalous access patterns during the full 13-month exposure window. Enforce MFA on all SSO-integrated systems. Coordinate with relevant provincial health authorities and report under applicable PHIPA obligations.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.