Quadrangle Imaging Center Listed by incransom Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People who have visited Quadrangle Imaging Center for scans or related care may now face questions about whether their personal and medical details have been taken by criminals. On August 22, 2025, the ransomware group known as incransom listed the center on its leak site, claiming it had stolen internal files. The number of people affected remains unknown, and public detail is limited, yet any exposure of patient records carries lasting practical risks for those involved.

This report sets out only what has been stated so far. It does not assume the claim has been independently verified, nor does it invent missing numbers, dates, or methods. The goal is to give affected individuals a clear picture of the situation and the steps they can take.

Breaking down the breach

According to the available record, Quadrangle Imaging Center was listed by the incransom ransomware group on August 22, 2025. The group claims that internal files were exfiltrated during a ransomware attack. No further public confirmation of the intrusion method, the exact date of the attack itself, or the volume of data taken has been provided. The number of people whose information may be involved is listed as unknown.

The reported summary of the claimed material includes patients’ personal data and related medical information, information used for organizing appointments and feedback, and accounting and finance records. Contact details associated with the organization—mri@qicpr.com, ct@qicpr.com, xr@qicpr.com, and the telephone number 787-746-1688—also appear in the listing. Beyond these statements, the scale, technical details, and current status of any negotiation or data release remain undisclosed.

Who is incransom?

Incransom is a ransomware group that operates in the well-documented pattern of double extortion: encrypting systems while also stealing data and threatening to publish it if a ransom is not paid. Like other groups of this type, it maintains a leak site on which it posts the names of organizations it claims to have compromised, often accompanied by samples or descriptions of the stolen files. Public reporting on the group has noted its focus on a range of sectors, including healthcare and professional services, and its use of standard ransomware tactics such as initial access through phishing or vulnerable remote services, followed by lateral movement and data staging.

In this instance the group claims to have listed Quadrangle Imaging Center. That listing constitutes an unverified assertion by the actors themselves; no independent confirmation of the claim appears in the available facts. Readers should treat the group’s statements as claims rather than established fact until further evidence emerges.

Who is Quadrangle Imaging Center?

Quadrangle Imaging Center is a medical imaging facility. Organizations of this kind typically provide diagnostic services such as MRI, CT, and X-ray examinations, as suggested by the email addresses associated with the listing. They collect and store patient identifiers, clinical histories, appointment schedules, and billing information in the ordinary course of care. Because imaging centers sit at the intersection of clinical practice and administrative operations, a breach can affect both medical confidentiality and financial records.

A ransomware incident at such a facility is consequential for two reasons. First, the data held are sensitive by nature and can be reused for identity theft, insurance fraud, or targeted social engineering. Second, disruption of imaging services can delay diagnoses and treatment for patients who rely on timely scans. The facts do not state whether clinical operations were interrupted, only that the group claims internal files were taken.

The information in question

The facts name the exposed material as internal files exfiltrated in a ransomware attack. The accompanying summary lists patients’ personal data and related medical information, information for organizing appointments and feedback, and accounting and finance records. Contact addresses and a telephone number linked to the center are also referenced.

Exact contents of the files have not been independently verified or itemized in public reporting. Medical imaging centers ordinarily hold names, dates of birth, addresses, insurance details, referral notes, scan results, and appointment logs. Accounting systems may contain invoices, payment records, and vendor information. Because the precise data set remains unconfirmed, it is not possible to state with certainty which of these categories, if any, were included. The group’s claim should be regarded as an assertion pending further disclosure.

What's at stake

For individuals, the primary risks are identity theft, fraudulent use of insurance or medical information, and unwanted contact that exploits knowledge of recent medical visits. Personal data combined with appointment or clinical details can make phishing messages appear more credible. Financial records, if present, could enable billing fraud or attempts to open accounts in a patient’s name. These harms are concrete but not inevitable; their likelihood depends on whether the data are actually released and how they are used.

For the organization, the stakes include potential regulatory scrutiny under health-privacy rules, the cost of investigation and notification, and possible interruption of services if systems were encrypted. Reputational damage and the need to rebuild patient trust are also real considerations. None of these outcomes is asserted as fact in the available record; they are the ordinary consequences that follow when a healthcare provider is listed by a ransomware group.

Were you affected?

If you have been a patient or employee of Quadrangle Imaging Center, treat the listing as a reason for caution rather than confirmed exposure. Monitor bank and insurance statements for unexpected activity, place a fraud alert with the major credit bureaus if you wish, and be skeptical of unsolicited calls or emails that reference medical appointments or billing. Change passwords on any accounts that reuse credentials associated with the center, and enable multi-factor authentication where available.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets. That step will not confirm or rule out involvement in this specific incident, but it can surface other exposures that warrant attention. Public detail remains limited; further official notices from the organization or regulators, if they appear, should be read carefully for any confirmed list of affected individuals or recommended actions.

AICompiled with AI assistance from public sources and published under our editorial standards.