encom##### Listed by clop Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On December 24, 2024, the ransomware group clop listed encom##### on its leak site, claiming responsibility for a ransomware attack in which internal files were exfiltrated. Public reporting identifies the presumed victim as Encompass Health. The number of people affected is unknown, and further specifics about the scale or confirmation of the intrusion remain limited.

Such listings by ransomware groups typically signal an attempt at double extortion, where stolen data may be threatened with public release. For those connected to encom#####, the incident underscores the need to understand what is known and what practical steps follow.

Inside the incident

According to the available record, clop publicly listed encom##### on December 24, 2024. The group claimed that internal files had been exfiltrated during a ransomware attack. The reported summary attributes the announcement to Cl0p and states that the group holds data from many companies that use Cleo software; it further notes that the group’s teams were reaching out and offering a special secret chat. No independent confirmation of the intrusion, the volume of data taken, or the precise method of access has been disclosed in the facts. Timing of the underlying compromise, any ransom demand, and whether systems were encrypted are likewise unconfirmed.

The listing itself constitutes a claim by the group rather than verified evidence of successful data theft or impact. Public detail on the incident stops at the leak-site entry and the associated summary referencing Cleo users.

Inside clop

Clop, also styled Cl0p, is a well-documented ransomware group that has operated for several years using a double-extortion model: data is stolen before systems are encrypted, and the group threatens to publish the material on its leak site if payment is not made. The group has repeatedly targeted file-transfer and managed-file-transfer software, exploiting vulnerabilities to gain initial access at scale. Notable prior campaigns have involved MOVEit Transfer and other enterprise tools, resulting in large numbers of organizations being listed.

In late 2024, clop publicly associated itself with exploitation of vulnerabilities in Cleo software products. The group’s typical pattern includes mass scanning for exposed systems, automated data exfiltration, and subsequent contact with victims via leak-site postings and direct outreach. Claims made on the leak site, including those about encom#####, should be treated as assertions by the actor until corroborated by the affected organization or independent investigation.

Who is encom#####?

The organization appears in the record as encom##### and is presumed to be Encompass Health, a large U.S. healthcare provider focused on inpatient rehabilitation hospitals and related services. Organizations of this type operate extensive clinical networks, employ thousands of staff, and routinely handle protected health information, billing records, employee data, and operational files. A breach involving such an entity is consequential because healthcare data is both sensitive and regulated; unauthorized access can affect patients, staff, and business partners, and can trigger notification obligations under laws such as HIPAA.

Even when only internal files are named, the potential presence of clinical, financial, or personnel records elevates the stakes for individuals whose information may have been among the material claimed by the attackers.

What data was at risk

The facts state that internal files were exfiltrated in a ransomware attack. No further breakdown of file types, record counts, or specific categories of personal or health information has been disclosed. Exact contents therefore remain unconfirmed.

Organizations in the healthcare rehabilitation sector typically hold:

• Patient medical records and treatment histories
• Personally identifiable information used for admissions and billing
• Employee and contractor personnel files
• Internal operational, financial, and administrative documents

Whether any of these categories were present in the material claimed by clop is not established by the public record. The absence of confirmed data types means affected individuals cannot yet know with certainty what, if anything, of theirs was involved.

The real-world impact

For people whose data may have been taken, the primary risks are identity theft, medical identity fraud, phishing that leverages accurate personal details, and long-term exposure of sensitive health information. Even internal files can contain enough identifiers to enable targeted scams or unauthorized access to other accounts. Because the number of people affected is unknown and the precise data set is unconfirmed, the scope of individual harm cannot be quantified from public sources.

For the organization, a ransomware incident of this type can disrupt clinical and administrative operations, generate regulatory scrutiny, and create lasting reputational and financial costs associated with investigation, notification, and remediation. The claim that the group is actively contacting companies that use Cleo software adds pressure through direct outreach, a common tactic intended to accelerate negotiations.

Were you affected?

If you are a patient, employee, or partner of encom##### or the presumed Encompass Health organization, treat the listing as a reason for heightened caution rather than confirmed personal exposure. Monitor financial and medical statements for unusual activity, enable multi-factor authentication on important accounts, and be alert to unsolicited communications that reference the incident or request sensitive information. Consider placing fraud alerts with credit bureaus if you believe your identifiers may have been involved. Readers can also run a free exposure scan of their email address to check whether their information has already surfaced in known breach data sets. Official notifications, if any are required, will come directly from the organization; until then, public detail remains limited to the clop listing and the facts summarized here.

AICompiled with AI assistance from public sources and published under our editorial standards.