bdac.com.au Listed by incransom Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Breaking down the breach

The incident was reported on April 12, 2026, through a listing on the incransom group's site. The only confirmed detail is that internal files were removed during a ransomware attack. No information has been released on the number of records involved, the exact date of the intrusion, or the method used to gain access. The organisation has not issued a public statement confirming or denying the claims.

The group behind it: incransom

Incransom is a ransomware operation that follows the common pattern of encrypting systems and removing copies of data before demanding payment. The group maintains a public listing of claimed victims on a site accessible via the dark web. Such listings serve as a pressure tactic, with the group asserting that stolen material will be released if demands are not met. No independent verification of the bdac.com.au claim has been published in the available facts.

Who is bdac.com.au?

Bendigo and District Aboriginal Co-operative operates as a community-controlled organisation serving Aboriginal and Torres Strait Islander people in the Dja Dja Wurrung region. It has delivered health, education, employment, cultural and family services for more than fifteen years from three sites in Bendigo, including a medical clinic. The organisation is governed by a board elected by its members and employs more than fifty staff, the majority of whom identify as Aboriginal.

The information in question

The listing refers only to “internal files.” No further breakdown of file types, record counts or data categories has been provided. Organisations of this type routinely hold client health records, contact details, program participation information and administrative documents. The precise contents of the exfiltrated material remain unconfirmed.

What's at stake

Exposure of internal files from a community health and support service can affect individuals whose personal and health information is held by the organisation. Potential consequences include unauthorised access to sensitive records and possible misuse of contact or identity details. For the organisation itself, the incident may require forensic review, notification processes and remediation of any affected systems.

Were you affected?

Individuals who receive services from BDAC can contact the organisation directly for information on any notifications it issues. Checking personal email addresses against known breach databases provides one way to determine whether credentials or other details have appeared in public data sets. Monitoring bank and government accounts for unusual activity remains a standard precaution when personal information may have been exposed.

AICompiled with AI assistance from public sources and published under our editorial standards.