Open Door Health Center Listed by incransom Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
Open Door Health Center was listed by the incransom ransomware group on May 25, 2026, after internal files were exfiltrated in a ransomware attack affecting an undisclosed number of people. Individuals who may have received services from the organization should review any communications from Open Door Health Center and consider monitoring their accounts for unusual activity.
On May 25, 2026, the incransom ransomware group listed Open Door Health Center on its leak site. The number of people affected remains unknown, and the only detail provided is that internal files were allegedly exfiltrated during a ransomware attack.
The incident is one of many recent listings involving healthcare organizations, where patient data and operational records can carry elevated sensitivity.
Inside the incident
The available information is limited to the group’s listing of Open Door Health Center and the statement that internal files were taken. No confirmation of the attack method, the volume of data, or the timeline of events has been released publicly. The number of individuals whose information may be involved is also undisclosed.
Who is incransom?
Incransom is a ransomware operation that has appeared in multiple public listings over recent years. Groups of this type commonly use encryption to disrupt operations and exfiltrate data for additional leverage, then post victim names on dedicated sites to pressure organizations into payment. The listing of Open Door Health Center constitutes the group’s claim; independent verification of the underlying events has not been reported.
Who is Open Door Health Center?
Open Door Health Center, based in Illinois, has provided primary health care since 1977 through a medical-home model. Its services include medical care, HIV programs, behavioral health support, case management, and community outreach, with particular focus on LGBTQI individuals and people living with HIV/AIDS. Organizations in this sector routinely collect and store detailed personal, medical, and insurance information to deliver care and meet regulatory requirements.
The information in question
The only data category named in connection with the listing is internal files. The precise contents of those files have not been disclosed. Healthcare providers of this type typically maintain patient records, contact details, clinical notes, insurance information, and administrative documents; whether any of these categories were among the exfiltrated material remains unconfirmed.
Why it matters
Exposure of internal files from a health center can create long-term privacy and identity risks for patients, particularly when records involve HIV status, behavioral health, or other protected health information. For the organization, such an event may lead to regulatory scrutiny, operational disruption, and costs associated with investigation and notification. The absence of Reported Details leaves the full scope of potential impact unclear.
What to do if you're exposed
Individuals who believe their information may be involved should monitor their credit reports, review explanations of benefits from insurers, and consider placing fraud alerts with credit bureaus. Changing passwords for any linked accounts and enabling multi-factor authentication are standard first steps. Readers can run a free exposure scan of their email address against known breach data to check for appearances in public listings.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Aesthetic Surgical Images Listed by incransom Ransomware GroupColorado Rehabilitation & Occupational Medicine Claimed by IncRansomhamilton-eye.com Listed by incransom Ransomware GroupLife Bridges Non-Profit Claimed by Incransom RansomwareLatest breaches
Publicly posted by incransom — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.