The INC ransomware group has built a durable criminal operation not through technical sophistication but through deliberate sector selection and disciplined execution of well-understood attack methods. According to analysis published by Dark Reading, healthcare sits near the top of INC's target list precisely because clinical disruption — downed EHR systems, inaccessible imaging, paralyzed scheduling — creates conditions where administrators face immediate pressure to restore operations at almost any cost.
The structural problem
INC's approach illustrates a shift that threat researchers have tracked for several years: ransomware operators no longer need novel exploits when legacy fundamentals work reliably. Phishing campaigns, exposed remote-access services, and stolen credentials remain the dominant entry vectors. Healthcare organizations, which often run a wide mix of clinical systems with long patch cycles and broad remote-access requirements, present a consistently exploitable attack surface.
The group's sector-targeting logic is also straightforward. Unlike financial services firms, which may have practiced failover and can absorb days of degraded operations, many healthcare practices — particularly independent and community-based ones — have thin IT staff, limited backup infrastructure, and regulatory obligations that make prolonged downtime clinically and legally untenable. INC appears to have internalized that calculus.
What the attack pattern looks like
Dark Reading's reporting describes an operation that moves through a predictable sequence:
- Initial access through common vectors. Credential theft and exploitation of internet-facing remote-access services account for the majority of documented intrusions. Multi-factor authentication gaps are a consistent enabler.
- Dwell time before encryption. The group spends time inside a network before deploying ransomware, using that period to identify backup systems and high-value data stores, then disabling or exfiltrating before the destructive phase begins.
- Double extortion as standard practice. Encryption alone is no longer the primary leverage point. Exfiltration of patient data — and the threat of public disclosure — adds a separate HIPAA-breach liability dimension that increases payment pressure independent of whether the organization can restore from backups.
The combination means that even organizations with functional backup discipline face a breach-notification exposure that complicates the "restore and move on" response calculus.
Where this lands for independent practices
For small and mid-sized practices, the INC pattern reinforces several control priorities that do not require large security budgets to address.
Multi-factor authentication on every remote-access pathway — VPN gateways, remote desktop services, EHR web portals — remains the single highest-return control against credential-based initial access. The Dark Reading analysis makes clear that MFA gaps are a recurring enabler across INC intrusions.
Backup architecture deserves equal attention. Offline or immutable backup copies, tested regularly for restoration fidelity, reduce the operational leverage ransomware operators hold. The double-extortion dimension is harder to neutralize after the fact, which makes data minimization and access segmentation — limiting which systems can reach sensitive patient data — a meaningful preventive measure.
Patch cadence on internet-facing systems, particularly remote-access infrastructure, should be treated as a clinical-operations priority rather than a routine IT task. INC, like most active ransomware groups, exploits known vulnerabilities against organizations that have not applied available fixes.
What this signals about the next 12 months
The broader lesson from INC's trajectory is that ransomware groups targeting healthcare are not betting on zero-days or state-level tradecraft. They are betting that the same control gaps that existed two years ago still exist today. For many organizations, that bet remains correct.
Regulatory attention is increasing in parallel. OCR's proposed updates to the HIPAA Security Rule, published in late 2024, would formalize requirements around MFA, encryption, and network segmentation that directly address the vectors INC and similar groups exploit. Whether or not those rules finalize on their current timeline, the threat environment makes the underlying controls worth implementing now rather than in response to a future compliance deadline.