New Century Ophthalmology Group Listed by INC Ransom Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to pressure organisations by posting alleged victims on public leak sites, often before any independent confirmation exists. Those listings function as both publicity and leverage: they assert that data was taken and may be released, while leaving the public with incomplete and unverified information.

According to a listing dated August 31, 2026, the group known as INC Ransom has named New Century Ophthalmology Group on its leak site and claims to have stolen internal data. The company has not publicly confirmed the claim as of writing. How many people may be affected, what files if any were involved, and how the group says it obtained access are not detailed in the available public summary. For patients, staff, and partners, the practical question is what a leak-site claim does and does not establish—and what to do if personal or clinical information were later shown to be involved.

What is being claimed

INC Ransom has listed New Century Ophthalmology Group on its ransomware leak site. The group claims to have stolen internal data. Public reporting associated with the listing is dated August 31, 2026. The number of people potentially affected is unknown, and the types of data allegedly involved are not disclosed in the material provided for this account.

No confirmed technical timeline, intrusion method, ransom demand, or proof package is described in those facts. Listings of this kind are assertions by the claimant. They may later be corroborated, narrowed, disputed, or left unresolved. Until the organisation, a regulator, or another authoritative source speaks with verifiable detail, the responsible reading is that INC Ransom has made a public claim—not that an inventory of stolen records has been independently established.

The group behind it: INC Ransom

INC Ransom is a known ransomware and extortion actor that has appeared in public reporting over recent years. Like many groups in this category, it is associated with encrypting systems in some operations and with threatening to publish or auction data on a dedicated leak site when payment is refused or negotiations stall. Public descriptions of the group’s playbook typically include double-extortion style pressure: disruption inside the victim environment paired with the reputational and regulatory threat of data exposure.

Leak sites operated by such groups are marketing and coercion tools. Entries can be incomplete, recycled, exaggerated, or false. Screenshots, file trees, or sample documents—when they appear—are selected by the actor and are not a substitute for forensic validation. For this specific listing, the established point from the facts is limited: INC Ransom named New Century Ophthalmology Group and claims theft of internal data. Nothing in the provided record confirms the scale, sensitivity, or authenticity of any alleged haul beyond that claim.

Who is New Century Ophthalmology Group?

New Century Ophthalmology Group is an organisation operating in eye care and related clinical services. Ophthalmology practices and groups commonly manage outpatient visits, surgical scheduling, diagnostic imaging, prescriptions, billing, and coordination with referring physicians and insurers. Even without any confirmed incident, the sector is inherently sensitive because care delivery depends on identifiable patient information and on the continuity of clinical and administrative systems.

A leak-site listing naming a healthcare-related organisation matters because patients and staff reasonably worry about medical privacy, appointment and billing records, and identity-related misuse. That concern is about potential impact if claims were accurate—not a finding that particular systems failed or that any specific dataset left the organisation. Public detail on confirmation from New Century Ophthalmology Group is not part of the facts given here.

The information in question

The listing-related summary does not name exposed data types. Exact contents remain unconfirmed. INC Ransom’s claim refers to “internal data” in general terms only; that phrase is the actor’s description, not a verified catalogue.

If files from an ophthalmology group were ever taken, organisations in this sector typically hold some combination of patient demographics, contact details, insurance and billing information, clinical notes, diagnostic results, surgical or procedure records, referral correspondence, and employee or workforce records. They may also hold vendor contracts and routine business documents. None of those categories should be read as established as stolen in this case. They are the kinds of information such practices often maintain, offered only so readers can judge conditional risk if stronger evidence later appears.

Because counts of affected people are unknown and data types are undisclosed, no responsible article can state that a particular patient’s chart, a staff member’s payroll file, or any other specific record is in criminal hands. The public record described here supports only the narrower statement that a ransomware group has listed the organisation and claims internal data theft.

Why it matters

For individuals, the conditional risks that follow healthcare-adjacent extortion claims are familiar: if personal identifiers and contact data were involved, phishing and social engineering can become more convincing; if financial or insurance details were involved, account and benefits fraud become more plausible; if clinical information were involved, privacy harm and targeted scams framed around eye care or appointments could follow. Those outcomes depend on what, if anything, was actually taken and whether it is misused—points not settled by a leak-site name alone.

For the organisation, a public listing can drive patient anxiety, partner questions, and regulatory attention even while facts remain thin. Extortion crews rely on that uncertainty. Separating the claim from confirmed loss is therefore part of protecting both reputation and the public: treating every listing as proven theft would amplify the actor’s pressure campaign; ignoring listings entirely would leave people without practical guidance.

What a leak-site listing does establish is that a named group chose to associate this business with an extortion narrative on a given date. What it does not establish is negligence, the success of any intrusion, the completeness of any alleged dataset, or confirmed harm to any named individual.

What to do now

If you are a patient, employee, or partner of New Century Ophthalmology Group, treat the situation as a claim under watch rather than as proof that your records are public. Prefer official channels from the organisation for notices; be wary of unexpected messages that cite a “breach,” demand urgent payment, or push you to open attachments or click links. If you later receive a confirmed notice that your information was involved, follow that notice’s instructions, consider credit monitoring where appropriate, and review medical and insurance statements for unfamiliar activity.

In the meantime, strengthen ordinary hygiene: unique passwords, multi-factor authentication on email and financial accounts, and skepticism toward unsolicited calls about appointments, refunds, or settlements. You can also run a free exposure scan of your email to check whether your information has already surfaced in known breach data from unrelated incidents, which helps separate old exposures from any new claim still lacking confirmation.

Public detail remains limited. INC Ransom has listed New Century Ophthalmology Group and claims to have stolen internal data; the company has not publicly confirmed the incident as of writing, affected-person counts are unknown, and data types are not disclosed. Further clarity, if it comes, should come from verifiable organisational or regulatory statements—not from the extortion site’s marketing alone.

AICompiled with AI assistance from public sources and published under our editorial standards.