Ransomware Group: INCRANSOM

VICTIM NAME: Turning Leaf (TURNINGLEAF[.]local)

NOTE: No files or stolen information are [exfiltrated/downloaded/taken/hosted/seen/reposted/disclosed] by RedPacket Security. Any legal issues relating to the content of the files should be directed at the attackers directly, not RedPacket Security. This blog is simply posting an editorial news post informing that a company has fallen victim to a ransomware attack. RedPacket Security is in no way affiliated or aligned with any ransomware threat actors or groups and will not host infringing content. The information on this page is fully automated and redacted whilst being scraped directly from the INCRANSOM Onion Dark Web Tor Blog page.

AI Generated Summary of the Ransomware Leak Page

The ransomware leak page related to Turning Leaf Residential Rehabilitation Services, a company involved in the Mental Health & Rehabilitation Facilities industry, was discovered on January 29, 2025. The report indicates that the company has a workforce of approximately 250 to 499 employees and generates a revenue estimate between 5 million to 10 million dollars. The headquarters is located in Lansing, Michigan. However, the leak does not specify any additional information related to a compromise date, implying that such details may remain unspecified or unknown.

The leaked information is associated with an online blog post published on the dark web, which addresses the vulnerabilities the company has faced. It is crucial to note that no sensitive personal information has been explicitly referenced in the summary. The post does include a screenshot that visually represents aspects of the content, although specific details remain unspecified to maintain confidentiality. The overall implications of this leak signal a significant issue within the organization’s cybersecurity posture.