Lymphedema Therapy Specialists Listed by incransom Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On February 27, 2026, the ransomware group incransom listed Lymphedema Therapy Specialists on its data-leak site and claimed to have obtained internal files from the clinic. The number of individuals affected remains unknown, and no further details about the scale or timing of the intrusion have been made public. The incident adds to a continuing pattern of ransomware operations that target smaller healthcare providers holding sensitive patient information.

Inside the incident

The only confirmed information is the listing itself. The group asserts that files were taken during a ransomware attack, yet no independent confirmation of the exfiltration or of any encryption of systems has been released. The date the files were allegedly obtained, the volume of data, and whether any portion has been published are all undisclosed at this time.

Who is incransom?

Incransom is a ransomware operation that follows the double-extortion model common among current threat actors. After encrypting systems, the group typically exfiltrates data and lists the victim on a public leak site to pressure payment. The group has appeared in multiple incident reports over the past several years, usually claiming activity against organizations in North America and Europe. Its listings are treated as unverified claims until corroborated by the affected organization or by law-enforcement statements.

About Lymphedema Therapy Specialists

Lymphedema Therapy Specialists operates as a private outpatient clinic in Houston, Texas. The practice provides manual lymph drainage, pneumatic compression therapy, and wound care to patients managing chronic swelling and related conditions. Clinics of this type routinely collect and store patient identifiers, medical histories, insurance details, and treatment records in order to deliver care and process reimbursement.

What was likely exposed

The listing refers only to “internal files.” No inventory of specific data categories has been released by either the clinic or the group. Organizations in this sector commonly maintain electronic health records that include names, dates of birth, addresses, diagnoses, and billing information; however, whether any of these categories were present in the claimed exfiltration cannot be confirmed from available information.

Why it matters

Unauthorized access to internal files at a medical clinic can expose personal health information that patients reasonably expect to remain confidential. Even without confirmed publication of the data, the existence of the claim creates uncertainty for individuals who have received care at the facility. For the organization, the incident may trigger regulatory notification requirements and operational costs associated with investigation and system restoration.

Were you affected?

Patients of Lymphedema Therapy Specialists should monitor statements from the clinic for official guidance. In the absence of further details, standard protective steps include reviewing account statements for unusual activity, placing a fraud alert with credit bureaus if financial information may be involved, and contacting the clinic directly with questions about the scope of any exposure.

• Change passwords for any patient portals or related accounts.
• Request a copy of your medical records to verify what information is held.
• Run a free exposure scan of your email address against known breach datasets.

AICompiled with AI assistance from public sources and published under our editorial standards.