MENTAL HEALTH Listed by incransom Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 14 April 2025 the ransomware group incransom publicly listed MENTAL HEALTH on its leak site and claimed to hold more than one terabyte of the organisation’s internal files. For anyone who has received care from MENTAL HEALTH or its related services, the listing raises immediate practical questions about whether personal, clinical or administrative records could now be in unauthorised hands.

Public detail remains limited: the number of people affected is unknown, the precise date of the intrusion has not been disclosed, and the full contents of the claimed data set have not been independently verified. What is known is that a ransomware group asserts it has already removed internal material and is prepared to publish it.

What happened

According to the leak-site listing dated 14 April 2025, incransom states that it has exfiltrated internal files belonging to MENTAL HEALTH in a ransomware attack. The group further claims to possess more than one terabyte of company data, including “all personal c” (the listing text is truncated at that point). No independent confirmation of the intrusion, the volume of data, or the success of any encryption has been published. The number of individuals whose information may be involved is listed as unknown, and no further technical details about the method of entry or the timeline of the attack have been released by either the group or the organisation.

Who is incransom?

Incransom is a ransomware operation that follows the now-common double-extortion model: after gaining access to a network it both encrypts systems and steals copies of data, then threatens to publish the stolen material if a ransom is not paid. The group maintains a public leak site on which it names victims and, in many cases, posts samples or full archives of purportedly stolen files. Like other actors of this type, it has previously targeted organisations across multiple sectors, using the threat of data exposure as leverage. Claims made on such sites are assertions by the attackers; they are not independently verified statements of fact about any specific incident unless corroborated by the victim or by forensic evidence.

Who is MENTAL HEALTH?

MENTAL HEALTH appears in the listing in connection with Mental Health Partners, which the group’s own text notes has rebranded as Clinica Family Health & Wellness. The organisation describes itself as a provider of integrated, whole-person care that combines physical, oral and mental-health services. Entities of this kind routinely maintain electronic health records, appointment histories, billing information, insurance details and communications that contain highly sensitive personal data. A breach involving a mental-health or integrated-care provider is therefore consequential because the information at stake often includes diagnoses, treatment notes and other material that individuals reasonably expect to remain confidential.

The information in question

The only data types named in the available record are “internal files exfiltrated in ransomware attack.” The group additionally claims to hold more than one terabyte of material that includes “all personal c,” but the listing cuts off and does not enumerate specific categories such as patient names, medical records, Social Security numbers or financial data. Organisations that deliver mental-health and primary-care services typically store precisely those categories of information; however, the exact contents of the files allegedly taken in this incident remain unconfirmed. Public reporting has not established which systems were accessed or whether any particular individual’s records are among the material claimed by the group.

Why it matters

If the group’s claims are accurate, affected individuals face concrete risks that extend beyond ordinary identity theft. Mental-health and integrated-care records can reveal diagnoses, medications, therapy notes and personal circumstances that, if published or sold, may expose people to stigma, discrimination in employment or insurance, or targeted social-engineering attacks. For the organisation itself, the incident carries operational, regulatory and reputational consequences: healthcare providers are subject to strict privacy rules, and the mere listing of a victim on a ransomware leak site can erode patient trust even before any data is shown to have been misused. Because the scale of the breach and the precise data elements remain undisclosed, the full extent of these risks cannot yet be measured.

If your data was in this claimed breach

Until more detail emerges, people who have used services associated with MENTAL HEALTH or Clinica Family Health & Wellness can take a small number of practical steps:

• Monitor financial accounts, credit reports and any patient portals for unexpected activity.
• Enable multi-factor authentication on email, banking and healthcare accounts wherever it is offered.
• Be alert to phishing or social-engineering attempts that reference mental-health care or personal medical history.
• Contact the organisation’s privacy or patient-relations office to ask whether your records are believed to be involved and what support is available.
• Consider placing a fraud alert or credit freeze with the major credit bureaus if you have reason to believe sensitive identifiers may have been exposed.

Readers can also run a free exposure scan of their email address to check whether that address has already appeared in other known breach data sets; such a scan does not confirm or rule out involvement in this specific incident, but it can surface earlier exposures that warrant attention.

AICompiled with AI assistance from public sources and published under our editorial standards.