foundationstofreedom.org Listed by incransom Ransomware Group

On July 28, 2026, the non-profit organization Foundations to Freedom was listed on the leak site of the incransom ransomware group. The organization, a US-registered 501(c)(3) headquartered in DeLand, Florida, provides recovery housing, therapeutic support, and social adaptation programs for people overcoming substance abuse and survivors of domestic violence. The listing indicates that internal files were exfiltrated during a ransomware attack. The exact number of individuals whose data may be exposed remains unknown.

Details from the Leak Site

The primary disclosure on the incransom leak site states that internal files were exfiltrated from Foundations to Freedom in a ransomware incident. The listing does not quantify the volume of data taken, specify the exact file types beyond “internal files,” or name any particular categories of sensitive records. It also does not disclose whether client intake forms, donor records, employee personnel files, or medical-related documentation were included. As is typical with many ransomware leak-site postings, the group has set a publication deadline, though the precise date is not publicly detailed in the indexed entry.

The incident follows the group’s standard pattern of initial compromise, data exfiltration, encryption of systems where possible, and subsequent extortion pressure through public exposure of stolen material.

Why This Matters for You and Your Family

If you or a member of your family has received recovery housing, counseling, or support services from Foundations to Freedom, your personal information may now sit in an attacker-controlled archive. Non-profit service providers like this one routinely collect full names, dates of birth, Social Security numbers, addresses, phone numbers, emergency contacts, medical histories, substance-abuse treatment notes, and domestic-violence safety plans. When such records are stolen, the exposure is rarely limited to the individual client; household members, children, and even sponsors or guarantors can be pulled into the same dataset.

Even if you were not a direct client, employees, volunteers, and donors may have had tax documents, banking details, or personal identifiers stored in the compromised internal files. The breach therefore creates identity risk that extends beyond the immediate victims to their broader personal networks.

Doxxing and Identity-Chain Risks

Ransomware groups increasingly use stolen internal files not just for financial extortion but as raw material for doxxing chains. A single leaked intake form can link your real name and address to usernames, email accounts, phone numbers, and even children’s names or school information. These connections allow attackers or opportunistic criminals to map an entire household’s digital footprint. Credential leaks of this nature frequently cascade into gaming account takeovers, especially for families whose children use the same email addresses or passwords across both recovery-related services and online gaming platforms.

Once an identity chain is established, it can be sold, traded, or used to launch highly targeted spear-phishing, SIM-swapping, or blackmail campaigns. The sensitive nature of substance-abuse and domestic-violence records adds another layer: public exposure of such information can cause severe emotional harm, workplace discrimination, or housing denial.

Incransom’s Known Track Record

Public reporting attributes incransom with emerging in late 2024 as a double-extortion ransomware operation. The group is known for targeting mid-sized organizations, including healthcare providers, educational institutions, and non-profits. Notable prior victims have included regional treatment centers and social-service agencies. Their typical playbook involves gaining initial access through phishing or exploited remote desktop protocols, followed by aggressive data exfiltration before deploying ransomware. They then pressure victims with both encryption and the threat of publishing sensitive internal files on their leak site, often giving organizations a short window to pay before samples or full archives are released.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real-world identity, then use the no-subscription cleanup of Warden to break those chains where possible.
• Rotate any password you ever used at Foundations to Freedom or related services and enable 2FA through an authenticator app everywhere that password was reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information surfaces you are alerted within hours rather than months.
• Cover your entire household with DoxxScan family protection, which extends to dependents and children’s gaming accounts that often chain back to the same addresses and emails exposed in incidents like this.
• Let DoxxScan remediation specialists manage takedown requests and data-broker suppression for you instead of attempting manual removal across dozens of sites.

The breach of Foundations to Freedom is a reminder that even organizations dedicated to healing and safety can become vectors for identity compromise. Taking deliberate steps now limits how far attackers can travel down the identity chains they have been handed. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts vulnerable to credential-based takeovers.