incan.org.gt Listed by Krybit Ransomware Group

The listing on the Krybit ransomware leak site claims that records belonging to patients of INCAN — Guatemala’s leading private cancer treatment centre — have been taken. According to the group’s posting dated September 03, 2026, the organisation appears on their site as part of an extortion campaign. INCAN has not publicly confirmed the claim, data theft or contact with the group as of writing.

A listing is not proof

Ransomware and extortion crews routinely publish names of organisations on leak sites to pressure them into payment. These postings are marketing material produced by the attackers themselves. They frequently contain recycled data from older incidents, exaggerated claims, or listings that turn out to be false. No independent party — regulator, cybersecurity firm, or the organisation itself — has verified that any data left INCAN’s control. Until such confirmation exists, this remains an unproven accusation rather than an established fact.

What the absence of detail tells you

The Krybit listing does not name any specific categories of information, nor does it state how many individuals may be involved. Because no categories are listed, there is no basis to discuss particular risks tied to Social Security numbers, medical histories, financial details or any other field. The record also provides no incident date, only the September 03, 2026 filing date. Without knowing when any claimed event occurred, it is impossible to judge timing, response speed or relevance to your own situation.

Passwords and accounts in this context

The brief record mentions a password field may have been exposed, but the storage scheme is not disclosed. This uncertainty matters. If the passwords were stored with strong, slow hashing and proper salting, they would be resistant to mass cracking. If they were stored weakly, they could be easier to test. Because the method remains unknown, treat your INCAN-related password as potentially compromised. Change it immediately on the INCAN site and anywhere else you have reused the same password. Enable multi-factor authentication everywhere it is offered, especially on accounts linked to your healthcare or financial information.

The pattern of healthcare listings

Ransomware groups have repeatedly added healthcare organisations to leak sites as a pressure tactic, regardless of whether a genuine compromise occurred. Healthcare providers hold sensitive patient data that carries both emotional and financial value, making them attractive targets for public shaming. This pattern means future similar listings are likely. When you see a new healthcare-related posting, the same rule applies: treat it as a claim until independent confirmation appears. Do not assume every listing equals a real breach, but also do not dismiss every claim outright. Confirmation usually comes from the organisation itself through direct notifications or regulatory filings.

What you can still control

Even if this listing is accurate, no permanent government or biographic identifiers are known to may have been exposed in this record. That limits some long-term identity risks. The most practical step remains monitoring for any direct communication from INCAN. The organisation is required to notify affected individuals directly, usually by post. If you have not received such a letter, it usually indicates your records were not included. However, if you have changed address since the claimed events, contact INCAN directly to confirm your status.

Stay alert to unexpected communications claiming to be from INCAN or Krybit. Scammers often exploit breach announcements to launch phishing or extortion attempts of their own. Verify any request for information by contacting the organisation through official channels listed on their website.

GalaxyWarden provides continuous monitoring across 13.1 billion breach records and more than 100 platforms, with identity-chain mapping and remediation handled by specialists.