Turning Leaf (TURNINGLEAF.local) Listed by incransom Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People connected to Turning Leaf Residential Rehabilitation Services may now face uncertainty over whether personal or clinical information has left the organisation’s control. On 29 January 2025 the ransomware group known as incransom listed the company on its leak site, claiming it had exfiltrated internal files. The number of individuals affected remains unknown, and public detail about the precise contents of those files is limited. For anyone who has received care, worked for, or otherwise shared data with the organisation, the practical stakes are clear: sensitive records held by a mental-health provider can be used for identity fraud, targeted scams, or unwanted disclosure of private medical history.

This article sets out only what has been reported, places the claim in the context of how incransom typically operates, and outlines concrete steps people can take while further information is awaited.

Breaking down the breach

According to the available record, Turning Leaf (TURNINGLEAF.local) was listed by the incransom ransomware group on 29 January 2025. The group asserts that internal files were exfiltrated during a ransomware attack. No confirmed figure has been released for the number of people affected, and the exact date of the intrusion itself has not been disclosed. Public reporting describes the incident solely as a listing on the group’s leak site; independent verification of the volume or nature of the stolen data has not been published. In short, the claim of exfiltration stands as an unverified assertion by the threat actor, and many operational details remain undisclosed.

The group behind it: incransom

incransom is a ransomware operation that follows the now-common double-extortion model: after gaining access to a network, operators encrypt systems and simultaneously copy data, then threaten to publish the material if a ransom is not paid. The group maintains a dark-web leak site where it posts victim names and, in some cases, sample files or full archives. Public tracking of the group shows it has targeted organisations across multiple sectors, typically using phishing, compromised credentials, or unpatched remote-access services as initial entry points. Once inside, it moves laterally, disables backups where possible, and stages data for exfiltration before deploying the encryptor. The listing of Turning Leaf is therefore consistent with the group’s established pattern, but the specific claims made about this victim—namely that internal files were taken—should be treated as assertions rather than independently What's Publicly Reported.

Turning Leaf (TURNINGLEAF.local) and its sector

Turning Leaf Residential Rehabilitation Services operates in the mental-health and rehabilitation-facilities sector. Public business information places it in Lansing, Michigan, with a workforce of 250 to 499 employees and annual revenue in the range of 5 million to 10 million dollars. Organisations of this type provide residential treatment, counselling, and related support services. They routinely collect and store highly sensitive personal data: medical histories, treatment plans, medication records, insurance details, contact information for patients and families, and employment or payroll records for staff. Because the services involve mental-health care, the information is often more intimate and potentially stigmatising than ordinary medical data. A breach at such a facility therefore carries elevated consequences for privacy and personal safety, even when the precise files taken have not been enumerated.

What was likely exposed

The only data type named in the public record is “internal files exfiltrated in a ransomware attack.” No further breakdown—such as patient records, financial documents, or employee files—has been confirmed. Organisations in the residential rehabilitation sector typically hold electronic health records, intake assessments, progress notes, billing and insurance information, staff credentials, and administrative correspondence. Whether any of those categories were among the files claimed by incransom remains unconfirmed. Readers should therefore treat the exposure as limited to the general category of internal files until more specific inventories are released by the organisation or by independent investigators.

Why it matters

For individuals whose data may be involved, the principal risks are identity theft, fraudulent insurance claims, and social or professional harm if clinical details become public. Mental-health information can be especially damaging if misused for blackmail or discrimination. For the organisation itself, the incident raises operational, regulatory, and reputational concerns: potential notification obligations under health-privacy laws, possible disruption of care services, and the need to restore systems and rebuild trust. Because the number of affected people is unknown and the exact contents of the files remain undisclosed, the full scope of these risks cannot yet be quantified, but the sensitivity of the sector makes even a limited exposure consequential.

What to do if you're exposed

If you have been a patient, family member, or employee of Turning Leaf, practical first steps can reduce immediate harm while more information emerges:

• Monitor bank, credit-card, and insurance statements for unfamiliar activity and consider placing a free fraud alert or credit freeze with the major credit bureaus.
• Be alert to phishing or social-engineering attempts that reference mental-health treatment or claim to come from the organisation; verify any contact through known official channels.
• Request a copy of your medical records from the provider so you have a baseline of what information exists about you.
• Change passwords on any accounts that may have shared credentials with systems used by the organisation, and enable multi-factor authentication wherever available.
• Run a free exposure scan of your email address against known breach data sets to check whether your contact details have already appeared in other incidents.

These measures do not reverse an exfiltration, but they limit the window in which stolen information can be exploited. Continue to watch for official statements from Turning Leaf or from regulatory authorities that may clarify the scope of the incident.

AICompiled with AI assistance from public sources and published under our editorial standards.