incan.org.gt Listed by Krybit Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to pressure organisations by posting names on leak sites before any independent confirmation exists. In that climate, a listing is a public claim, not a verified incident report, and it should be read with that distinction in mind.

On September 03, 2026, the group known as Krybit listed incan.org.gt on its leak site. The listing refers to INCAN — Instituto de Cancerología y Hospital Dr. Bernardo del Valle S., described in the reported summary as Guatemala's premier private cancer treatment institution. As of writing, the organisation has not publicly confirmed the claim. How many people might be affected, what data if any was involved, and how any intrusion allegedly occurred remain undisclosed in the available record. The claim matters because healthcare and cancer-care settings hold sensitive personal and clinical information, so even an unverified listing can raise understandable concern among patients, families, and staff.

What the listing says

According to the listing, Krybit has named incan.org.gt as a victim on its leak site. The reported date associated with that appearance is September 03, 2026. Public detail in the record does not include a confirmed method of access, a timeline of alleged activity inside any network, a ransom demand amount, or a file inventory. The number of people affected is unknown. Data types named as exposed are not disclosed. The short reported summary identifies the organisation as INCAN — Instituto de Cancerología y Hospital Dr. Bernardo del Valle S., and characterises it as a leading private cancer treatment provider in Guatemala, but does not expand into technical or forensic detail.

A leak-site entry of this kind is an assertion by the posting group. It does not, by itself, establish that systems were compromised, that files left the organisation, or that any particular dataset is circulating. Until the organisation, a regulator, or another independent source confirms otherwise, the responsible reading is that Krybit claims to have material related to the institution and has chosen to publicise that claim.

The group behind it: Krybit

Krybit is known in public reporting as a ransomware and extortion-style actor that uses leak sites to amplify pressure. Groups in this category typically claim to have encrypted or exfiltrated data, then threaten publication unless terms they set are met. Their postings often mix partial samples, screenshots, or marketing language with assertions about the scale of a haul. Those materials are controlled by the claimant and are not a substitute for a forensic inventory.

For this specific listing, only what appears in the facts can be attributed: Krybit has listed incan.org.gt, with the report dated September 03, 2026, and without disclosed counts, data categories, or technical narrative beyond the organisational identification in the summary. Any broader pattern of how Krybit has operated against other targets in the past does not prove what happened here. The group claims association with this name; that claim has not been confirmed by the organisation in the material available for this article.

About incan.org.gt

incan.org.gt is associated with INCAN — Instituto de Cancerología y Hospital Dr. Bernardo del Valle S., a private cancer-focused medical institution in Guatemala. Organisations of this type typically provide oncology diagnosis, treatment, hospital care, and related outpatient services. They sit at the intersection of clinical care, patient administration, and often research or specialised programmes, which means they routinely handle identity, contact, insurance or billing, and highly sensitive health information.

A leak-site claim against a named cancer institute is consequential because the people connected to such a centre—patients in active treatment, survivors in follow-up, relatives, referring clinicians, and employees—have a strong interest in knowing whether their records could be at risk. That interest does not require treating an unconfirmed listing as proof. It does require clear communication about what is and is not established, and about practical steps if personal data later appears in known breach collections or is confirmed by the institution.

The information in question

The facts state that data types named as exposed are not disclosed. It is therefore not possible to assert which systems, databases, or document sets—if any—were involved. Claiming a specific inventory would go beyond the record and would treat the attackers' marketing as fact.

If files from a cancer hospital or institute of this kind were ever taken, organisations in this sector typically hold combinations of patient identifiers, contact details, clinical histories, imaging and pathology-related records, appointment and billing data, and staff or contractor information. That is a description of ordinary holdings in oncology care, not a statement that any of those categories left INCAN's control. Exact contents tied to this listing remain unconfirmed. Readers should treat any later sample or dump attributed to this name with the same caution: verify provenance, and wait for organisational or official confirmation where possible.

What's at stake

For individuals, the conditional risk is misuse of personal and health-related information if such data were obtained and circulated: targeted phishing that references real treatment details, identity fraud using stolen identifiers, embarrassment or discrimination from exposure of a cancer diagnosis, or pressure scams aimed at patients and families. Those harms depend on whether data was actually taken and what it contained—points the public listing does not settle.

For the organisation, an extortion listing can disrupt trust, divert attention to crisis communication, and create operational load even when the underlying claim is disputed or incomplete. None of that establishes negligence or confirms a breach. What a leak-site listing does establish is that a named group has chosen to associate the institution with a public pressure campaign. What it does not establish is the truth of the technical claims, the scope of any alleged theft, or the current status of patient and staff data.

What to do now

If you are a patient, family member, or employee connected to INCAN, watch for official notices from the institution rather than relying solely on criminal leak sites. Treat unexpected messages that cite your care, ask for money, or demand urgent action as potential scams until you verify them through known channels. Consider placing fraud alerts or extra monitoring on financial accounts if you later learn that identity documents or payment data were involved. Use unique passwords and multi-factor authentication on email and patient-portal accounts where available, and be cautious about sharing additional personal data in response to unsolicited contact.

If you want a practical check on whether your email address has already appeared in known breach datasets unrelated or related to public dumps, you can run a free exposure scan of your email. That kind of check does not prove or disprove this specific listing, but it can help you prioritise password changes and monitoring if your address shows up elsewhere. Remain conditional: act as if your data might be at risk if confirmation emerges, without assuming that Krybit's claim has already put your records in the open.

AICompiled with AI assistance from public sources and published under our editorial standards.