Onecare Listed by incransom Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People who rely on home and community support services, or whose relatives do, often share sensitive personal and health details with the organisations that help them stay independent. When such an organisation appears on a ransomware group’s leak site, the practical question for clients, families and staff is whether those details have been taken and what that could mean for their privacy and security.

On 15 December 2024, the organisation known as Onecare (also styled ONE CARE) was listed by the ransomware group incransom. Public reporting describes the incident as involving the exfiltration of internal files in a ransomware attack. The number of people affected has not been disclosed, and further technical detail remains limited.

Inside the incident

According to available public information, Onecare was listed by the incransom ransomware group on or around 15 December 2024. The reported summary characterises the event as a ransomware attack in which internal files were allegedly exfiltrated. No confirmed figure for the number of individuals affected has been released, and the precise method of initial access, the duration of any intrusion, and the full scope of systems involved have not been publicly detailed.

Ransomware incidents of this type typically involve both encryption of systems and the theft of data for later pressure or publication. In this case, the public record centres on the group’s listing of the organisation and the statement that internal files were taken. Beyond that, timing of detection, any negotiation, and whether data has been released remain undisclosed in the information provided.

The group behind it: incransom

Incransom is a ransomware operation that has appeared in public threat reporting as a group that encrypts victim systems and exfiltrates data, then lists organisations on a dedicated leak site to increase pressure. Like other actors in this category, it commonly claims to have stolen internal documents and threatens to publish them if demands are not met. Its listings are claims made by the group itself and should be treated as such unless independently confirmed by the victim organisation or official investigators.

In this instance, the group claims that Onecare is a victim and that internal files were exfiltrated. No further specific claims about the content of those files, ransom amounts, or deadlines have been supplied in the facts available for this report. Public knowledge of incransom’s broader pattern of activity does not substitute for verified detail about this particular case.

Onecare and its sector

ONE CARE provides a range of supportive care services that enable seniors and people with disabilities to enjoy better quality of life as they age at home. ONE CARE Home & Community Support Services is a community-based, charitable, not-for-profit health organisation providing supportive care to families in Huron and Perth Counties and surrounding area. The agency was formed in 2011 when three long-standing Huron and Perth organisations came together as ONE CARE.

Organisations in the home and community support sector routinely handle personal identifiers, contact details, health and care assessments, service records, and information about family members or caregivers. Because the work involves vulnerable populations and ongoing relationships of trust, a breach involving internal files can raise particular concern about privacy, continuity of care, and the potential for misuse of sensitive information. The charitable, community-focused nature of the service also means many clients and families may have limited resources for responding to identity or privacy risks.

What was likely exposed

The facts state that internal files were exfiltrated in a ransomware attack. No more granular inventory of data types—such as specific categories of personal, health, financial or employee records—has been publicly named. The exact contents therefore remain unconfirmed.

Organisations of this kind typically hold client demographic and contact information, care plans, medical or functional assessments, scheduling and service notes, staff records, and administrative or financial documents related to operations. It is reasonable to expect that some combination of such material could be among internal files, but without an official disclosure it is not possible to state what was actually taken. Readers should treat any assumption about particular data elements as provisional until confirmed by the organisation or regulators.

What's at stake

For individuals whose information may have been involved, the main risks are privacy intrusion, potential identity misuse if personal identifiers were present, and the possibility of targeted phishing or social-engineering attempts that reference genuine care relationships. Health-related or disability-related details, if included, can be especially sensitive and difficult to change. Family members listed as contacts may also face secondary exposure.

For the organisation, the stakes include operational disruption from ransomware, the cost and complexity of investigation and recovery, reputational harm among clients and partners, and potential regulatory or contractual obligations to notify affected people and authorities. Because the number of people affected is unknown and the precise data set is undisclosed, the full scale of these risks cannot yet be measured from public information alone.

What to do if you're exposed

If you are a client, family member or staff member of Onecare and are concerned that your information may have been involved, begin by monitoring official communications from the organisation for any confirmed notification or guidance. Review bank, credit and government accounts for unexpected activity, and be cautious of unsolicited emails, calls or messages that reference your care relationship or personal details. Consider placing fraud alerts with credit bureaus where available, and keep records of any suspicious contact.

You can also run a free exposure scan of your email address to check whether that address has already appeared in known breach data sets. Doing so does not confirm or rule out involvement in this specific incident, but it can help you understand your broader exposure and prioritise further protective steps such as password changes and multi-factor authentication on important accounts.

AICompiled with AI assistance from public sources and published under our editorial standards.