Washington Gastroenterology (DHSWA.NET) Listed by incransom Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target healthcare providers as a high-value sector, where operational disruption and sensitive patient information create strong pressure to pay. Listings on criminal leak sites have become a routine part of these campaigns, even when independent confirmation of the underlying intrusion remains limited.

On January 17, 2025, the ransomware group known as incransom listed Washington Gastroenterology (DHSWA.NET) among its claimed victims. Public detail is limited: the number of people affected is unknown, and the only data description available is that internal files were allegedly exfiltrated in a ransomware attack. The listing itself is an unverified claim by the group.

Breaking down the breach

According to the available record, Washington Gastroenterology (also referred to as WAGI and associated with DHSWA.NET) was listed by the incransom ransomware group on January 17, 2025. The report states that internal files were exfiltrated as part of a ransomware attack. No further technical details—such as the initial access method, the duration of unauthorized access, encryption of systems, ransom demands, or any negotiation—have been disclosed in the public facts. The number of individuals potentially affected remains unknown. Because the primary source is the group’s own leak-site listing, the incident should be treated as a claimed event pending independent verification or official confirmation from the organization.

Who is incransom?

Incransom is a ransomware operation that follows the now-common double-extortion model: operators encrypt systems and simultaneously steal data, then threaten to publish the material if payment is not made. Like other groups in this category, incransom maintains a public leak site where it posts victim names and, in some cases, sample files to increase pressure. The group has been observed targeting a range of organizations across multiple sectors; healthcare and professional services have appeared among its claimed victims in public reporting. Tactics typically include phishing or exploitation of remote-access services for initial entry, followed by lateral movement, data staging, and deployment of ransomware. Specific claims made by incransom about any single victim, including Washington Gastroenterology, should be read as assertions by the threat actor rather than independently Reported Facts.

Washington Gastroenterology (DHSWA.NET) and its sector

Washington Gastroenterology (WAGI) was formed through the merger of three western Washington gastroenterology practices: Digestive Health Specialists (Tacoma/South Puget Sound), Northwest Gastroenterology Associates, and Overlake Internal Medicine Associates – Gastroenterology (both Bellevue/Eastside). The combined practice launched on January 1, 2018, and describes itself as the largest private GI practice in Washington state, with a history of providing digestive-health care spanning nearly five decades. Gastroenterology practices routinely manage clinical records, appointment and billing data, insurance information, and communications among physicians, staff, and referring providers. Because such organizations sit at the intersection of clinical care and administrative systems, any confirmed compromise can affect both patient privacy and day-to-day operations. A ransomware listing against a large regional specialty practice therefore carries elevated consequences even when the precise scope remains unconfirmed.

What data was at risk

The public facts state only that internal files were exfiltrated in a ransomware attack. No inventory of specific data categories—such as patient names, medical records, Social Security numbers, financial details, or employee information—has been released. Organizations of this type typically hold protected health information, demographic and contact data, insurance and billing records, and internal operational documents. Until the organization or an independent investigation provides a confirmed list, the exact contents of any stolen material remain unconfirmed. Readers should treat any assertion of particular data types beyond “internal files” as speculative.

The real-world impact

For individuals whose information may have been among the exfiltrated files, the primary risks include potential misuse of personal or health-related data for identity theft, targeted phishing, or medical-identity fraud. Because the number of affected people is unknown and the precise data types are undisclosed, the scale of individual exposure cannot yet be quantified. For the organization itself, a ransomware incident can interrupt clinical scheduling, billing, and electronic health-record access, create regulatory notification obligations under HIPAA and state law, and generate reputational and financial costs. Even when systems are restored, the lingering possibility that stolen data will appear on criminal forums remains a longer-term concern for both patients and staff.

What to do if you're exposed

If you are a patient, employee, or business partner of Washington Gastroenterology and believe your information may have been involved, take the following practical steps:

• Monitor bank, credit-card, and insurance statements for unfamiliar activity and consider placing a fraud alert or credit freeze with the major credit bureaus.
• Be alert for phishing emails or calls that reference the practice or claim to offer breach-related assistance; verify any communication through official channels.
• Request a copy of your medical records and review them for unexpected entries that could indicate medical-identity misuse.
• If you receive formal notification from the organization, follow the specific guidance and any free credit-monitoring offers it provides.
• Run a free exposure scan of your email address against known breach data sets to check whether your credentials or personal details have already appeared in other incidents.

Public detail on this particular listing remains limited; continued monitoring of official statements from Washington Gastroenterology is the most reliable way to learn whether additional confirmed information becomes available.

AICompiled with AI assistance from public sources and published under our editorial standards.