Inner City Family Health Team (ICFHT.local) Listed by incransom Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People who have received primary care from Inner City Family Health Team may now face uncertainty about whether their personal and medical information has been taken by criminals. On 23 December 2024 the organisation was listed by the ransomware group known as incransom, which claims to have stolen internal files. Because the number of people affected remains unknown and the precise contents of the files have not been publicly detailed, those who have used the service—particularly individuals who are homeless or previously homeless—have limited information with which to assess their own risk.

The listing itself is an unverified claim by the group. Public detail about the incident is limited, yet any compromise of health-related records carries lasting consequences for privacy, safety and access to care. This article sets out only what is known from the available record and the established patterns of such attacks.

What happened

On 23 December 2024 Inner City Family Health Team, identified in the listing as ICFHT.local, appeared on the leak site operated by the incransom ransomware group. The group claims that internal files were exfiltrated in a ransomware attack. No further technical details—such as the method of initial access, the date the intrusion began, the volume of data taken, or whether systems were encrypted—have been disclosed in the public record. The number of people whose information may be involved is listed as unknown. The organisation has not, in the material available for this report, issued a detailed public confirmation or denial of the claim.

Ransomware incidents of this type typically involve both encryption of systems and theft of data for leverage. In this case the only concrete assertion is the group’s claim that internal files were removed. Beyond that single statement, timing, scale and method remain undisclosed.

Who is incransom?

Incransom is a ransomware operation that has been active in recent years and follows the now-common double-extortion model. After gaining access to a network, operators encrypt files to disrupt operations and simultaneously copy data so they can threaten to publish it if a ransom is not paid. Victims who refuse or cannot pay are routinely listed on a dedicated leak site, often with samples or full archives of stolen material released over time.

The group has previously claimed responsibility for attacks across multiple sectors, including healthcare, manufacturing and professional services. Like many contemporary ransomware crews, it appears to rely on initial access brokers, phishing, or exploitation of unpatched remote-access services, though the precise entry vector used against any single victim is rarely confirmed by independent sources. Public reporting treats listings on its site as claims rather than Reported Facts until the victim or law-enforcement agencies provide corroboration. No statements attributed to incransom about Inner City Family Health Team beyond the basic listing itself appear in the available facts.

About Inner City Family Health Team (ICFHT.local)

Inner City Family Health Team provides primary care to homeless and previously homeless individuals in Toronto. Family health teams in Ontario are interdisciplinary clinics that deliver comprehensive primary-care services, including medical assessment, chronic-disease management, mental-health support and coordination with social services. Because their patients often face housing instability, the organisation holds records that link medical histories with highly sensitive personal circumstances.

A breach involving such a clinic is consequential precisely because of the population it serves. Clients may have limited ability to monitor credit, change contact details, or navigate identity-recovery processes. Medical and social information, once exposed, can be used for targeted fraud, stigma, or interference with ongoing care. The organisation’s role as a trusted provider of essential services means any loss of confidentiality can also erode the willingness of vulnerable people to seek help in future.

What was likely exposed

The only data type named in the available record is “internal files exfiltrated in ransomware attack.” No inventory of those files—patient lists, clinical notes, administrative records, staff information or financial documents—has been published. Exact contents therefore remain unconfirmed.

Organisations of this kind typically maintain electronic medical records containing names, dates of birth, health-card numbers, diagnoses, prescriptions, appointment histories and contact details. They may also hold referral letters, housing-status notes, and correspondence with other agencies. Staff directories, payroll data and internal emails are common components of “internal files.” None of these categories can be asserted as factually present in the stolen material; they are simply the categories such a clinic would normally possess. Until a fuller disclosure is made by the organisation or by independent investigators, the precise scope of exposure stays unknown.

What's at stake

For individuals, the principal risks are identity theft, medical fraud and unwanted disclosure of sensitive personal circumstances. Stolen health information can be used to open fraudulent accounts, submit false insurance claims, or blackmail patients. Because many clients of Inner City Family Health Team experience homelessness or recent housing instability, they may lack stable addresses or digital access needed to detect and correct misuse quickly. Emotional harm from the exposure of mental-health or substance-use records is an additional, non-financial consequence.

For the organisation the stakes include operational disruption, regulatory scrutiny under Canadian privacy law, potential civil liability, and damage to the trust required to serve a hard-to-reach population. Even if systems are restored, the knowledge that data left the network can deter future patients from seeking care. Public detail on whether systems were encrypted, how long the intrusion lasted, or what remediation steps have been taken remains limited.

Were you affected?

If you have ever been a patient or staff member of Inner City Family Health Team, treat the possibility of exposure seriously until more information emerges. Monitor bank and credit statements for unfamiliar activity, request a free credit report, and consider placing a fraud alert with the major Canadian credit bureaux. Be alert to phishing attempts that reference medical appointments or personal details. If you receive notification from the organisation itself, follow the instructions it provides for further support.

You can also run a free exposure scan of your email address to check whether that address has already appeared in known breach data sets. Doing so will not confirm or rule out involvement in this specific incident, but it can reveal whether your credentials or personal information have surfaced elsewhere and prompt timely password changes. Keep records of any suspicious contacts and report confirmed identity fraud to the appropriate authorities.

AICompiled with AI assistance from public sources and published under our editorial standards.