The INC Ransom gang has added Health Sciences Centre (HSC) Winnipeg (hsc.mb.ca) to its leak site. HSC is Manitoba's largest public hospital. The group says it stole patient medical records, employee payroll and banking data, and internal network documents. None of this is confirmed. None of the eight sources is a primary statement from the victim or a regulator. The provincial health authority, Shared Health, has not confirmed any data theft. Its earlier statements, as reported, said personal health and financial data were not accessed. The listing gives no record count and no data volume, and no data appears to have been published yet. The sources also disagree on when the attack happened. This brief separates what the group claims from what has been reported, and treats the claim as unverified.
What Happened
What is on public record. A cybersecurity incident hit HSC on August 10, 2026, according to the Winnipeg Free Press. It affected door access and heating, ventilation and air conditioning (HVAC) systems. The Free Press described it as a ransomware attack. A later analysis piece reports more effects: central HVAC monitoring and maintenance systems went down, the hospital's security office was closed, and ID access cards could not be issued or updated. Shared Health says patient care and clinical operations were not affected. On September 10, a month after the attack, it told the Free Press only that a forensic investigation with outside cybersecurity experts was "ongoing." An internal memo from HSC chief operating officer Monika Warren updated staff on which systems were hit, but little of that has been made public.
The leak site claim. Breach House indexed the INC Ransom listing on October 11, 2026, and records the listing date as October 10. QPulse reports the group "stated the attack occurred on October 10." Recent Breaches gives a different timeline: it lists the incident as "occurred August 2026" and publicly claimed October 11. Accounts differ on the date. The most likely reading is that October 10 is when the group posted the listing, not when it broke in, and that the claim relates to the August 10 incident. No source confirms that link, though, and a second, separate intrusion cannot be ruled out.
In the listing, the group says it "chose not to completely disrupt the facility's operations" out of concern for patients. That fits the reported impact, which hit building systems rather than clinical ones. The group also says HSC management "stated that no sensitive data had been affected, despite having been informed otherwise." Hospital-side reporting supports the first half of that sentence. One commentary source says Shared Health's initial review suggested personal health and financial data were not accessed. Nothing independent supports the second half.
Breach House lists the leak status as "pending" and the victim's disclosure as "not disclosed yet." Several aggregators (Hendry Adrian, Recent Breaches) explicitly label the claim unverified.
What Was Taken
Everything below comes from the group's own listing, as reproduced by Breach House, QPulse and Hendry Adrian. None of it has been verified.
- Patient medical records: full names, dates of birth, addresses, phone numbers, hospital medical record numbers, diagnoses, medical history, allergies, medications, lab results, imaging reports, appointment dates, treatment details and physician information.
- Employee and healthcare professional data: names, contact details, dates of birth, employee numbers, employment, payroll and banking information, professional credentials, work schedules and department assignments.
- Financial and insurance records: billing records, payment histories, and insurance or benefits claims.
- Confidential hospital documents: internal emails, staff communications, system configurations, network diagrams and security procedures.
Volume: No source gives a record count, file count or data size. The group calls it "the largest data breach among healthcare institutions," which is a typical extortion boast with nothing to back it. Recent Breaches describes the number of affected people as "undisclosed." Readers should not cite any figure for this incident.
Not related: CBC News reported in late September that about 234,000 people may be affected by a breach at Maximus Canada, a service provider to Health P.E.I., involving a 2011 health card file. That is a separate incident with no reported link to HSC or INC Ransom. It belongs in this brief only as context: Canadian provincial health systems keep getting breached, both directly and through their suppliers.
Why It Matters
Hospital building systems are a way in. The confirmed impact at HSC was on door access, HVAC and badge issuance, not clinical IT. The Manitoba Nurses Union president, Darlene Jackson, warned that losing door control at a hospital with a history of violent incidents lets people enter unnoticed. Defenders who treat building management and physical access systems as "facilities" rather than IT are leaving a gap that ransomware crews are now visibly exploiting.
The victim and the attacker give opposite accounts. If INC Ransom's list is accurate, the network diagrams, system configurations and security procedures matter more than the patient records. They would give any later attacker a map of a critical provincial hospital. If Shared Health's initial finding holds, the listing is pressure without substance. Until forensic results are published, defenders and patients cannot tell which is true. The Free Press piece makes this point: silence after an attack helps the attacker.
Warnings were given in advance. According to one secondary source, Manitoba's auditor general, Tyson Shtykalo, warned in 2024 that Shared Health's lack of annual incident-response testing and cybersecurity training could slow its response to an incident. That finding has not been checked against the original audit report for this brief.
INC Ransom targets healthcare. The group runs double extortion: it steals data, then threatens to leak it. Its public line about sparing patients is reputation management, not restraint. The usual sequence is listing first, then a countdown, then publication. HSC's "pending" status suggests the group is still in the negotiation window.
The Attack Technique
No source establishes how the attackers got in. Shared Health has not released findings, and the group has not described its entry point.
The only technical signals come from a single OTHER-tier source, QPulse, citing third-party data:
- Hudson Rock infostealer intelligence reportedly shows four compromised third-party employee credentials linked to the hsc.mb.ca domain.
- ParanoidLab exposure analysis reportedly found 3,618 leaked passwords, 110 of them rated critical, linked to the domain.
These numbers have not been independently confirmed and do not prove the entry point. They do fit a pattern common to INC Ransom and its peers: getting in with valid stolen credentials through VPN, remote access or a supplier's access, rather than through a novel exploit. The reported impact on building systems also fits a flat network, where a foothold in corporate IT can reach building controllers. Both are inferences, not findings.
What Organizations Should Do
- Separate building and physical security systems from the rest of the network. Put HVAC, building management and badge-access controllers in their own network zones with strict, monitored crossing points. Keep a manual fallback for door control, such as staffed entrances and printed access lists, and test it.
- Find and reset stolen credentials. Check infostealer and leaked-credential feeds for your domains and your suppliers' accounts. Force resets, and require phishing-resistant MFA on every remote access route, starting with supplier and contractor accounts.
- Control supplier access. Review every third-party account with network access. Limit each one by time and scope, and log what it does. The Maximus Canada and Health P.E.I. case shows supplier-side breaches reach patient data too.
- Protect your network documentation. Treat network diagrams, configuration exports and security procedures as sensitive data. Restrict access to them and alert on bulk access or large outbound transfers.
- Test incident response every year and plan what you will tell the public. Run tabletop exercises that include losing building systems and facing a leak site claim. Decide in advance what you will disclose and when, so silence does not become the default.
- Prepare for a possible leak. Watch the INC Ransom leak site for HSC data. If the claim is confirmed, the stolen payroll and banking details would put staff at risk of follow-up phishing and payroll fraud. Warn staff about that risk now.
Sources: Incransom Group Claims Data Breach of Health Sciences Centre (hsc.m... | 234,000 people may be affected in personal information breach, says... | Transparency paramount after cyberattacks to prevent future breache... | Incransom Claims Data Theft at Winnipeg Health Sciences Centre · cy... | hsc.mb.ca — INCRANSOM Ransomware Attack Breach House | hsc.mb.ca Ransomware Claim (2026) — What’s Alleged & Am I Affected? | Ransomware Attack: How Manitoba's Largest Hospital is Coping with t... | Winnipeg's Health Sciences Centre: The Impact of a Cyberattack (2026)