Ikron Corp. Discloses Dual Ransomware Attack Affecting 11,845 Individuals Ikron Corp., a nonprofit providing behavioral health, employment, and education services in Cincinnati, Ohio, and Seattle, Washington, reported a data breach impacting 11,845 individuals across the U.S. The incident, disclosed to the U.S. Department of Health and Human Services on May 4, 2026, stemmed from a ransomware attack detected in February 2026, though the initial intrusion occurred on December 23, 2025. An investigation revealed two separate unauthorized parties accessed Ikron Corp.’s systems. The first extracted administrative and employment-related data, including records of current and former employees. A second intrusion, discovered on March 4, 2026, targeted the organization’s electronic health records, exposing protected health information (PHI) such as clinical notes, diagnoses, treatment plans, and insurance details. Additional compromised data included vocational service records, intake assessments, and program participation files. On March 28, 2026, the ransomware group Exitium claimed responsibility, asserting it had exfiltrated 278 GB of data and threatened to publish it within days. Exposed information included: - Personally identifiable information (PII): Names, addresses, dates of birth, Social Security numbers, and driver’s license numbers. - Protected health information (PHI): Medical histories, diagnoses, treatment plans, medication details, and insurance data. - Vocational and employment records: Intake forms, service notes, education history, and program participation details. Ikron Corp. is notifying affected individuals as they are identified and offering 12 months of complimentary credit monitoring. The organization has established a dedicated helpline for impacted individuals seeking further assistance.