foundationstofreedom.org Listed by incransom Ransomware Group: What Was Exposed & What To Do

On July 28, 2026, the US non-profit foundationstofreedom.org was listed by the ransomware group known as incransom. Public reporting states that internal files were exfiltrated in a ransomware attack. The number of people affected remains unknown, and further operational details have not been disclosed.

The listing matters because the organisation works with people in recovery from substance abuse and survivors of domestic violence. Any exposure of internal material from such a setting can carry lasting personal and organisational consequences, even when the precise contents and scale are still unconfirmed.

Inside the incident

According to the available record, foundationstofreedom.org appeared on incransom’s listings on July 28, 2026. The group’s claim centres on the exfiltration of internal files during a ransomware attack. No confirmed figure for affected individuals has been released, and public detail does not describe the initial access method, the duration of any intrusion, whether systems were encrypted, or whether a ransom demand was issued or paid.

At present the incident is known principally through the threat actor’s listing. Independent confirmation of the full scope, the exact timeline, or the complete set of taken materials has not been made public. Organisations in this position typically investigate, contain affected systems, and assess what left the network; those steps, if under way, have not been detailed in the material available here.

Who is incransom?

Incransom is a ransomware operation that, like many contemporary groups, has been observed using double-extortion tactics: encrypting systems while also copying data and threatening to publish it if payment is not made. Such groups commonly maintain leak sites where they name victims and, in some cases, release samples or larger archives to increase pressure.

Public reporting on incransom has described the familiar pattern of initial access followed by lateral movement, data theft, and deployment of ransomware. Listings on these sites constitute claims by the actors themselves. In this case, the appearance of foundationstofreedom.org should be understood as the group asserting that it obtained internal files; it does not by itself constitute independent verification of every detail of the intrusion or of the full contents of any archive.

About foundationstofreedom.org

Foundations to Freedom is a US-registered 501(c)(3) non-profit headquartered in DeLand, Florida. It provides recovery housing, social adaptation programs, and therapeutic support for people overcoming alcohol and substance abuse and for survivors of domestic violence. Its stated purpose is to offer a safe, structured environment in which individuals can rebuild stability and pursue long-term sobriety.

Organisations of this kind routinely handle sensitive personal information: intake and case records, health and treatment details, housing and contact data, and communications with clients, staff, and partner agencies. A breach affecting such an entity is consequential because the people it serves are often in vulnerable circumstances, and because trust and confidentiality are central to the work. Disruption of systems or exposure of internal files can affect both day-to-day operations and the willingness of individuals to seek help.

The information in question

The public record names the exposed material as internal files exfiltrated in a ransomware attack. No further breakdown of file types, record counts, or specific data categories has been disclosed. It is therefore not possible to state as fact which fields or documents were taken.

Non-profits that deliver recovery housing and therapeutic services typically maintain client identifiers, treatment and progress notes, emergency contacts, staff records, financial and donor information, and operational documents. Any of these could in principle be present in internal file stores. Until a fuller accounting is published by the organisation or by independent investigators, the exact contents remain unconfirmed, and assumptions about particular data elements should be avoided.

The real-world impact

For individuals connected to the organisation—clients, former residents, staff, or family contacts—the primary risks are misuse of personal information, unwanted contact, or the distress of knowing that sensitive life circumstances may have left a controlled environment. Even without confirmed identity-theft metrics, exposure of recovery or domestic-violence-related material can create lasting privacy and safety concerns.

For the organisation itself, consequences can include operational interruption, the cost of investigation and remediation, potential regulatory or contractual notification duties, and damage to the trust on which its programs depend. Because the number of people affected is unknown and the precise data set is undisclosed, the full extent of harm cannot yet be measured. The prudent stance is to treat the incident as a serious claim requiring verification and protective steps rather than as a fully mapped event.

If your data was in this breach

If you have been a client, resident, staff member, or otherwise linked to foundationstofreedom.org, monitor accounts and communications for unusual activity, be cautious of unexpected messages that reference the organisation or your personal situation, and consider placing fraud alerts or credit freezes if you believe financial or identity data could be involved. Retain any official notices the organisation may issue. You can also run a free exposure scan of your email address to check whether your information has already appeared in known breach data sets, which can help you decide what further monitoring is warranted.

Public detail on this incident remains limited. Further clarity will depend on official statements from the organisation and on any additional verified reporting. Until then, treat the incransom listing as a claim, protect your accounts and personal information, and rely on confirmed sources rather than speculation.

AICompiled with AI assistance from public sources and published under our editorial standards.