hsc.mb.ca Listed by INC Ransom Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

A ransomware group known as INC Ransom has listed hsc.mb.ca — associated with the Health Sciences Centre in Winnipeg — on its leak site, claiming it obtained data from the institution. As of writing, the organisation has not publicly confirmed the claim. For patients, staff, and others who may have dealt with a major hospital, the practical stakes are straightforward: if personal or medical information were ever taken and published, it could mean unwanted exposure of sensitive details and a lasting need to watch for misuse.

Public detail is limited. The listing does not establish what, if anything, left the organisation’s systems, how many people might be involved, or whether any files will appear online. What follows separates the group’s claims from confirmed fact and outlines conditional steps people can take if they are concerned.

What is being claimed

According to material attributed to INC Ransom, the group listed hsc.mb.ca on or around October 11, 2026. The listing presents the Health Sciences Centre in Winnipeg as a target and asserts that the group obtained data in what it describes as a large healthcare-related incident. The group further claims it chose not to fully disrupt clinical operations, citing potential harm to patients, and that management stated no sensitive data had been affected even after the group said otherwise.

The same listing language refers to patient medical records and begins to describe related information, but the provided record does not complete that inventory, and the structured facts state that data types named as exposed are not disclosed. People affected are listed as unknown. Timing of any intrusion, technical method, volume of material, and whether any data was actually published remain undisclosed in the material available for this article. INC Ransom’s statements are claims on a leak site; they are not independent verification.

The Health Sciences Centre has not, as of writing, publicly confirmed that a breach occurred or that the group’s description is accurate. Readers should treat the entire episode as an unverified extortion-site allegation until a company statement, regulator, or other authoritative source says otherwise.

Inside INC Ransom

INC Ransom is a ransomware and extortion actor known publicly for encrypting systems when it can, exfiltrating copies of data, and pressuring organisations by threatening to publish material on a dedicated leak site if demands are not met. Like other groups in this category, it typically relies on initial access through common weak points — such as exposed remote services, stolen credentials, or phishing — then moves laterally and stages data before deployment of ransomware, though the exact path in any single case is often never confirmed publicly.

The group’s leak site functions as both a pressure tool and a marketing channel: listings name victims, sometimes include sample descriptions of files, and set countdowns or publication threats. Those descriptions are written by the attackers. They can exaggerate scale, recycle older material, or mischaracterise what was obtained. Notable prior activity attributed to INC Ransom in open reporting has involved organisations across multiple sectors, including healthcare and other environments where downtime and data sensitivity create leverage. None of that history proves what happened in this specific listing.

For this incident, the only victim-specific assertions available here are those in the leak-site style summary: that the group targeted the Health Sciences Centre, that it claims a major data event, that it says it limited operational disruption, and that it disputes any assurance that sensitive data was untouched. Those points remain the group’s claims.

Who is hsc.mb.ca?

hsc.mb.ca is the web domain associated with the Health Sciences Centre in Winnipeg, Manitoba — one of the region’s major medical institutions. Centres of this kind typically provide acute care, specialist services, emergency treatment, and related clinical and administrative functions. They sit at the centre of care pathways for large numbers of patients and work closely with regional health systems, clinicians, and support staff.

A claimed incident involving such an organisation is consequential because hospitals and health sciences centres routinely handle information that is both personal and medically sensitive. Even an unconfirmed listing can create anxiety for patients and employees, prompt questions from partners and regulators, and force the institution to investigate and communicate carefully. A leak-site claim does not by itself prove theft or exposure; it does mean the public is being told a serious allegation about a named healthcare provider, which is why clear attribution and caution matter.

What data was at risk

The structured facts state that data types named as exposed are not disclosed, and the number of people affected is unknown. The attackers’ own summary language mentions patient medical records and implies a broader set of information, but that language is part of the extortion narrative, not a verified inventory. Exact contents, if any files were taken at all, are unconfirmed.

If files were taken from an organisation in this sector, firms and hospitals of this kind typically hold categories such as:

• Patient identifiers and contact details used for registration and care coordination
• Clinical records, notes, test results, and treatment histories
• Scheduling, referral, and administrative correspondence
• Staff or workforce-related records used to run the facility
• Billing, insurance, or payment-related information tied to care

None of the above should be read as a statement that those categories were copied or published in this case. Public detail on what, if anything, left the environment is limited to the group’s unverified listing text.

Why it matters

For individuals, the real-world risk is conditional. If medical or personal data related to care at a major centre were ever exposed, possible consequences include targeted phishing that references real appointments or conditions, attempts at identity fraud using demographic details, and long-term privacy harm that cannot be fully reversed once records circulate. Healthcare data is valuable to criminals precisely because it is hard to change and can be used to build convincing scams.

For the organisation, a public leak-site listing — true or false — can affect trust, trigger internal investigation costs, and draw attention from patients and oversight bodies. That pressure is why extortion groups list healthcare names. What a listing does establish is only that a named crew chose to associate this domain with its brand and its claims. What it does not establish is confirmed compromise, a verified file list, patient impact counts, or any conclusion about how the organisation defends its systems. Those points remain open absent confirmation from the institution or another authoritative source.

If your data was involved

Because nothing here is confirmed, treat the following as precautions if you believe you may have been a patient, visitor, or staff member connected to the Health Sciences Centre and you are worried the listing could relate to you.

• Be sceptical of unexpected calls, emails, or messages that cite hospital details, unpaid bills, or “breach assistance”; verify through official channels you already trust.
• Watch financial and insurance statements for unfamiliar activity and use credit or fraud alerts where those tools are available in your jurisdiction.
• Prefer unique passwords and multi-factor authentication on email and health-portal accounts so a single leaked password is less useful.
• Keep records of any suspicious contact that references your care, in case you later need to report it.
• Do not assume your records are online solely because a group posted a claim; wait for official guidance when it exists.

You can also run a free exposure scan of your email address to check whether that address has already appeared in other known breach datasets. That kind of check cannot prove or disprove this specific listing, but it can show whether your email is already circulating elsewhere and whether you should tighten account security. Stay calm, rely on official updates from the institution if they are issued, and treat INC Ransom’s leak-site statements as allegations until independently confirmed.

AICompiled with AI assistance from public sources and published under our editorial standards.