TriCity Family Services Hit by INC RANSOM Ransomware Attack, Exposing Sensitive Data of 2,511 Individuals TriCity Family Services, a healthcare provider, suffered a ransomware attack attributed to the INC RANSOM group, resulting in the exposure of personally identifiable information (PII) and protected health information (PHI) for 2,511 individuals. The threat actors claimed to have stolen 22 GB of data during the breach, which occurred between November 11, 2024, and May 14, 2025. The unauthorized access was discovered in spring 2025, prompting the organization to secure its systems and launch an investigation with a third-party cybersecurity forensics firm. While electronic medical records remained unaffected, the compromised data included names, dates of birth, treatment details, provider names, and intake information. TriCity Family Services reported the breach to the U.S. Department of Health and Human Services on December 8, 2025, and published a formal notice on its website. The organization has since updated its data security policies and established a dedicated call center (888-360-9994) for affected individuals to assist with credit monitoring and fraud prevention. The exposed data could be exploited for identity theft, targeted scams, or other malicious activities, underscoring the risks of ransomware attacks on healthcare providers.

TriCity Family Services Hit by Ransomware Attack, Exposing Sensitive Data of 2,511 Individuals TriCity Family Services, a nonprofit mental health care provider based in Geneva, Illinois, suffered a ransomware attack that compromised the sensitive personal and health information of 2,511 individuals. The breach, detected in spring 2025, involved unauthorized access to the organization’s systems between November 11, 2024, and May 14, 2025. The attack was claimed by the ransomware group INC RANSOM, which posted details of the hack on the Tor network. A third-party cybersecurity forensics firm was brought in to investigate, confirming that an unauthorized actor accessed and exfiltrated files containing personally identifiable information (PII) and protected health information (PHI). TriCity reported the incident to the U.S. Department of Health and Human Services (HHS) on December 8, 2025. The exposed data included names, dates of birth, presenting problems, requested treatments, treatment locations, and provider names though electronic medical records were not affected. Affected individuals have been advised to monitor financial accounts, review credit reports, and check insurance statements for suspicious activity. TriCity has set up a dedicated call center (888-360-9994) for inquiries, operating Monday through Friday from 9 a.m. to 9 p.m. ET. Legal firms are now investigating potential compensation claims for those impacted by the breach.