The Pennsylvania Office of the Attorney General (OAG) has confirmed that personal and medical information was stolen during the August 2025 ransomware attack carried out by the INC Ransom group. The attack caused major operational outages across the agency and resulted in the exfiltration of sensitive files before systems were encrypted.
Below is a clear breakdown of what information was exposed, what risks impacted individuals should consider, and the actions you should take now.
1. What Datapoints Were Leaked?
Following an internal review, the Pennsylvania OAG verified that the attackers accessed and stole files containing highly sensitive personal data.
Confirmed Exposed Information
Depending on the individual, the compromised files may include:
- Full name
- Social Security number (SSN)
- Medical information
This combination of personal and health-related data significantly elevates the severity of the breach.
Scale of the Breach
The INC Ransom gang claims to have stolen:
- 5.7 TB of files, including internal documents
- Files that allegedly provided access to an FBI internal network (still unconfirmed by authorities)
How the Breach Happened
While the OAG has not released full technical details, cybersecurity researchers identified:
- Public-facing Citrix NetScaler appliances on the OAG network
- These systems were vulnerable to Citrix Bleed 2 (CVE-2025-5777)
- The devices were taken offline only after the attack window had already opened
Operational Impact
When the breach was discovered on August 9th, attackers disrupted:
- The OAG website
- Employee email accounts
- Landline phone systems
This attack represents one of the most disruptive incidents targeting a Pennsylvania state agency in recent years.
2. Should You Be Worried?
If your data was part of this breach, yes — you should take this incident seriously, especially because of the types of information exposed.
High Identity Theft Risk
Stolen SSNs and names allow attackers to commit:
- Government benefits fraud
- Tax refund fraud
- New account fraud
- Medical identity theft
These risks can persist for years.
Potential Medical Information Misuse
Exposed medical details increase risks of:
- Extortion attempts
- Targeted scams
- Insurance fraud
Medical identity theft is often harder to detect and resolve.
Long-Term Threat Landscape
INC Ransom is a ransomware-as-a-service (RaaS) operation known for:
- Stealing massive datasets
- Publishing sensitive information if no ransom is paid
- Targeting government, healthcare, retail, and education institutions
Their victim list includes Yamaha Motor Philippines, NHS Scotland, Ahold Delhaize, and Xerox Business Solutions.
Confirmed State-Level Target
This is the third major ransomware incident involving Pennsylvania public entities, showing ongoing targeting by sophisticated threat actors.
Given the sensitivity of the exposed data, individuals should consider themselves at high risk for long-term fraud and targeted attacks.
3. What Should Be Your Next Steps?
If you receive a notification from the Pennsylvania OAG — or believe your information may have been affected — take these steps immediately:
1. Monitor and Protect Your Identity
Because SSNs were exposed:
- Place a credit freeze with all major credit bureaus
- Enroll in identity monitoring (OAG may provide services)
- Check for unauthorized credit inquiries
- Monitor tax filings for early fraudulent returns
2. Watch for Medical Identity Fraud
Review:
- Insurance statements
- Explanation of Benefits (EOB) documents
- Medical billing records
Report any unfamiliar activity to your insurer and providers.
3. Strengthen Your Online Security
Even if passwords weren’t compromised, follow best practices:
- Update passwords for government, medical, and financial portals
- Enable multi-factor authentication
- Review security questions—especially if they link to personal history
4. Stay Alert for Targeted Scams
After breaches involving medical or government data, common scams include:
- Fake IRS or SSA calls
- “Medical billing correction” scams
- Threats pretending to be law enforcement
- Phishing emails claiming to be from the OAG or FBI
Do not click links or share personal information unless you verify the requester.
5. Document Everything
If fraud occurs:
- Keep email logs
- Save billing statements
- Collect evidence for insurance disputes or identity theft claims
Having documentation helps when working with law enforcement or credit agencies.
