INC Ransomware Group Holds Healthcare Hostage in Oceania

Authorities in Australia, New Zealand and Tonga warn that the INC ransomware operation has targeted healthcare and professional services across Oceania—ACSC logged 11 Australian incidents between July 2024 and December 2025, INC published stolen data in New Zealand, and a June 2025 attack on Tonga’s Ministry of Health disrupted national health services; INC operates as a RaaS using initial access brokers, spear-phishing, and exploits, performing lateral movement, privilege escalation, encryption and exfiltration of PII/PHI, and responders recommend basic mitigations such as MFA, patching, and network access controls.