Ransomware Group: INCRANSOM

VICTIM NAME: heartlineoklahoma[.]org

NOTE: No files or stolen information are [exfiltrated/downloaded/taken/hosted/seen/reposted/disclosed] by RedPacket Security. Any legal issues relating to the content of the files should be directed at the attackers directly, not RedPacket Security. This blog is simply posting an editorial news post informing that a company has fallen victim to a ransomware attack. RedPacket Security is in no way affiliated or aligned with any ransomware threat actors or groups and will not host infringing content. The information on this page is fully automated and redacted whilst being scraped directly from the INCRANSOM Onion Dark Web Tor Blog page.

AI Generated Summary of the Ransomware Leak Page

The ransomware leak pertains to HeartLine OK, a healthcare-related organization serving the community by providing access to health, wellness, and social support services. The attack was discovered on July 22, 2025, with the compromised data initially exposed on July 21, 2025. The organization has approximately 26 employees and generates around 5 million dollars in annual revenue. The breach involved the unauthorized access and exfiltration of sensitive information, including internal data related to personnel and third-party communications, with a total of 20GB of data downloaded by malicious actors. The leak includes screenshots of internal documents and cybersecurity tools used by the attackers.

The threat actors, operating under the group named “incransom,” also exploited infostealer malware, particularly RedLine, to harvest additional information from compromised systems. The publicly available leak page features a screenshot of the victim’s internal interface, indicating a significant security breach. Although specific PII such as individual names or contact details was not disclosed, the leak highlights the attack on a critical health services provider. The organization’s focus on health and wellness services underscores the potential impact of this data breach on vulnerable community members and staff. The incident underscores the importance of cybersecurity measures in protecting sensitive health data from cybercriminals.