Ransomware Group: INCRANSOM

VICTIM NAME: Medical Center of Marin

NOTE: No files or stolen information are [exfiltrated/downloaded/taken/hosted/seen/reposted/disclosed] by RedPacket Security. Any legal issues relating to the content of the files should be directed at the attackers directly, not RedPacket Security. This blog is simply posting an editorial news post informing that a company has fallen victim to a ransomware attack. RedPacket Security is in no way affiliated or aligned with any ransomware threat actors or groups and will not host infringing content. The information on this page is fully automated and redacted whilst being scraped directly from the INCRANSOM Onion Dark Web Tor Blog page.

AI Generated Summary of the Ransomware Leak Page

The ransomware leak pertains to the Medical Center of Marin, a healthcare provider located in the United States. The attack was discovered on June 25, 2025, and involved the unauthorized access and potential exfiltration of sensitive patient data. Despite being a provider of urgent care services in the Bay Area, the medical center opted to prioritize their financial interests over safeguarding patient confidentiality. The breach has been publicly disclosed on a dark web leak page, which includes a screenshot of internal documents related to the incident.

The leak page indicates the presence of stolen data, which may include sensitive medical information. Although specific data files or download links are not detailed here, the publication of the leak signifies a serious compromise of patient privacy and institutional security. The incident underscores the importance of robust cybersecurity measures within healthcare institutions, especially given their handling of highly confidential health records. The leak’s public documentation aims to warn stakeholders and highlight vulnerabilities, with the attackers possibly demanding ransom for data decryption or to prevent further dissemination.