Heart to Heart Hospice Listed by incransom Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People who have received care from Heart to Heart Hospice, or whose relatives have, may now face uncertainty about whether personal or medical details have left the organisation’s control. On 29 January 2025 the hospice was listed by the ransomware group incransom, which claims to have taken internal files during an attack. The number of people affected remains unknown, and public detail about exactly what was taken is limited, yet the stakes are clear: hospice records often contain sensitive health and personal information that can be misused long after the initial incident.

What is known so far is that the group asserts it exfiltrated internal files. No independent confirmation of the full scope has been made public, so those connected to the organisation are left weighing the practical risks of identity misuse, medical privacy loss, and potential follow-on fraud.

Inside the incident

Public reporting states that Heart to Heart Hospice was listed by the incransom ransomware group on 29 January 2025. The listing characterises the event as a ransomware attack in which internal files were allegedly exfiltrated. Beyond that claim, key details remain undisclosed: the precise date the intrusion began, how the attackers gained access, the volume of data taken, and whether systems were encrypted or merely copied. The number of individuals whose information may be involved is also unknown. No official statement from the organisation confirming or denying the full extent of the claim has been included in the available facts, so the incident rests on the group’s public listing and the limited summary that accompanies it.

The group behind it: incransom

incransom is a ransomware operation that follows the now-common double-extortion model. After gaining access to a network, the group typically steals data before encrypting systems, then threatens to publish the stolen material on a dedicated leak site if a ransom is not paid. Like other groups in this category, it maintains a public-facing portal where it lists victims and, in some cases, releases sample files or full archives. The group has been observed targeting a range of sectors, including healthcare and related services, because those organisations hold data that is both valuable and sensitive. Its listings are claims made by the attackers themselves; they are not independent verification that every asserted detail is accurate. In this instance the group claims Heart to Heart Hospice’s internal files were taken, but that assertion has not been independently confirmed in the available record.

Who is Heart to Heart Hospice?

Heart to Heart Hospice is a palliative-care provider headquartered in Plano, Texas, and established in 2003. It offers services for patients with life-limiting illnesses, including pain management, symptom control, medication management, personal care assistance, and physical, occupational and speech therapy. Organisations of this type routinely handle clinical notes, medication lists, insurance details, contact information for patients and families, and other records that are highly personal. A breach involving such an organisation is consequential because the data can reveal intimate details of a person’s health status and family circumstances at a vulnerable time, and because the trust placed in hospice care is foundational to the service itself.

The information in question

The available facts state only that internal files were exfiltrated in a ransomware attack. No further breakdown of specific data types—such as medical records, Social Security numbers, financial account details or employee information—has been publicly disclosed. Hospice organisations typically maintain patient demographics, clinical assessments, treatment plans, billing and insurance data, and emergency contacts. Whether any or all of those categories were among the files claimed by incransom remains unconfirmed. Readers should therefore treat the precise contents as unknown rather than assume any particular category of information was or was not involved.

The real-world impact

For individuals, the primary risks are identity theft, medical identity fraud, and unwanted contact or scams that exploit knowledge of a serious illness. Stolen health-related data can be used to open fraudulent accounts, submit false insurance claims, or craft highly convincing phishing messages. Because the number of people affected is unknown, anyone who has been a patient, family member or employee of the hospice may reasonably wonder whether their information is among the files. For the organisation the consequences include potential regulatory scrutiny under health-privacy rules, the cost of investigation and notification, and the longer-term erosion of patient and family trust. These outcomes are concrete even when the full scale of the incident remains unclear.

Were you affected?

If you or a family member have received services from Heart to Heart Hospice, consider the following practical steps:

• Monitor bank, credit-card and insurance statements for unfamiliar activity and place a free fraud alert or credit freeze with the major credit bureaus if you notice anything suspicious.
• Be alert to unexpected calls, emails or texts that reference hospice care or medical needs; treat unsolicited requests for personal information as potential scams.
• Request a copy of your medical records from the hospice or your primary physician so you have a baseline of what should be on file.
• Run a free exposure scan of your email address against known breach data sets to see whether your contact details have already appeared in other incidents.

Public detail remains limited, and the listing by incransom is an unverified claim. Staying watchful and taking these basic precautions is the most useful response available while further information, if any, emerges.

AICompiled with AI assistance from public sources and published under our editorial standards.