Regent Care Center Listed by incransom Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Regent Care Center, a skilled nursing and rehabilitation provider operating as Regent Care Center of Oakwell Farms, was listed by the ransomware group known as incransom on or around September 10, 2024. Public reporting indicates that internal files were exfiltrated during a ransomware attack, though the number of people affected remains unknown and further operational details have not been disclosed.

The listing places the organization among those claimed by the group as victims of data theft and encryption. For residents, families, and staff connected to a facility that handles sensitive health and personal information, the incident raises practical questions about what may have been taken and what steps follow. Exact confirmation of the attack’s full scope has not been made public beyond the group’s claim and the reported exfiltration of internal files.

Inside the incident

According to available records, Regent Care Center was named on the incransom leak site as of the September 10, 2024 reporting date. The sole data-related detail provided is that internal files were allegedly exfiltrated in a ransomware attack. No figures have been released for the volume of data, the number of systems involved, or the precise timeline of intrusion, encryption, or discovery. Methods used by the attackers, any ransom demand, and whether systems were restored from backups or other means remain undisclosed. The listing itself constitutes the group’s claim that it holds and may publish the stolen material; independent verification of the full contents or of successful encryption has not been detailed in public sources tied to this report.

Because the count of affected individuals is listed as unknown and no inventory of specific file categories beyond “internal files” has been released, the public picture of the incident is limited to the fact of the listing and the statement that exfiltration occurred. Organizations in this position typically investigate, notify regulators where required, and assess whether personal or clinical records were among the taken material, but those steps and their outcomes are not described in the available facts.

Inside incransom

Incransom is a ransomware operation that follows the now-common double-extortion model: after gaining access to a network, operators encrypt systems and simultaneously steal data, then threaten to publish the material on a dedicated leak site if payment is not made. Groups of this type typically gain initial access through phishing, compromised credentials, or unpatched remote services, move laterally, and exfiltrate large volumes of files before deploying the encryptor. Public listings on their sites serve both as pressure on the victim and as advertising to other potential targets.

Like other ransomware crews active in recent years, incransom has been observed naming organizations across multiple sectors, including healthcare and long-term care. The group’s claims are published on its own infrastructure and should be treated as assertions by the actors rather than independently audited facts unless corroborated. No statements attributed specifically to incransom about Regent Care Center beyond the act of listing the organization appear in the provided record; therefore any further characterization of what the group says it holds remains limited to the general claim of internal-file exfiltration.

About Regent Care Center

Regent Care Center of Oakwell Farms provides comprehensive rehabilitation and skilled nursing services. Its stated approach centers on individualized treatment plans developed jointly by staff and physicians, with the goal of maximizing each resident’s progress. The organization’s public description emphasizes quality care in a residential setting that is intended to feel warm and secure for residents and their families, while also supporting professional growth for associates and sound fiscal management.

Facilities of this type operate in the long-term care and post-acute sector. They routinely maintain clinical records, medication histories, insurance and billing information, contact details for residents and next of kin, and employment records for staff. Because the care setting involves vulnerable adults who often cannot easily monitor their own data, any compromise of internal systems carries heightened practical consequences for privacy, continuity of care, and trust. The listing by a ransomware group therefore touches both the operational resilience of the facility and the personal information of people who rely on it.

What was likely exposed

The facts state only that internal files were exfiltrated. No further breakdown of file types, record counts, or categories of personal data has been disclosed. In the absence of that inventory, it is not possible to assert which specific fields or documents were taken.

Organizations that deliver skilled nursing and rehabilitation typically hold electronic health records containing diagnoses, treatment notes, medications, and advance directives; demographic and contact data for residents and family members; Social Security numbers or other identifiers used for billing and insurance; financial and payment information; and personnel files for employees. Any or all of these categories could theoretically be present among “internal files,” yet the exact contents of the material claimed by incransom remain unconfirmed. Readers should therefore treat any assumption about particular data elements as provisional until official notifications or forensic summaries become available.

Why it matters

For individuals whose information may have been among the exfiltrated files, the primary risks are identity theft, medical fraud, and targeted phishing that leverages accurate personal or clinical details. Stolen health data can be used to open fraudulent accounts, submit false insurance claims, or craft convincing social-engineering messages. Because many residents of skilled-nursing facilities are older adults, the practical burden of monitoring credit, insurance statements, and medical bills often falls on family members or guardians.

For the organization itself, a ransomware incident can disrupt clinical workflows, delay admissions or discharges, and require costly system restoration and legal compliance work. Even when care continues, the reputational and regulatory consequences of a confirmed data exposure can persist for years. The unknown scale of this event leaves both the facility and potentially affected people without a clear measure of exposure, which itself prolongs uncertainty.

If your data was in this claimed breach

If you are a current or former resident, family member, or employee of Regent Care Center, begin by watching for any official notice from the facility or its counsel; such notices typically describe what was taken and what protective steps are being offered. Place a fraud alert or credit freeze with the major credit bureaus, and review medical and insurance statements for unfamiliar activity. Change passwords on any accounts that may have shared credentials with workplace systems, and enable multi-factor authentication wherever it is available.

Because the full list of affected individuals has not been published, you may also wish to check whether your email address has already appeared in other known breach collections. Free exposure-scan tools can search public breach data for that address and provide an early indication of whether your information is circulating. Remain cautious of unsolicited messages that reference the incident or request personal details; legitimate communications will come through verified channels. Continued monitoring over the coming months is advisable, as stolen data is sometimes used long after the initial theft.

AICompiled with AI assistance from public sources and published under our editorial standards.