INC Ransom Claims Attack on Tanner Clinic, Utah Multispecialty Medical Group; Patient Data at Risk

A ransomware gang publicly claimed to have stolen sensitive patient data from a Utah multispecialty medical group before that organization had said a single word publicly about any incident.

On November 12, 2026, INC Ransom posted an allegation on its leak site claiming it had attacked Tanner Clinic, a multispecialty medical group serving patients across Weber and Davis counties in Utah. According to reporting via ClassAction.org and Ransomware.live, the attack is estimated to have occurred around October 28, 2026. INC Ransom claims to have obtained sensitive patient data, though the specific types of information and the number of patients potentially affected had not been verified independently as of this writing.

This is a reported breach claim, not an OCR enforcement action. No fine has been announced, and no regulatory finding has been made.

What We Know and What Remains Unconfirmed

The facts that can be stated with reasonable confidence at this stage are limited but significant:

• INC Ransom posted the claim on November 12, 2026.
• The alleged attack date is estimated at October 28, 2026.
• Tanner Clinic operates as a multispecialty outpatient medical group across at least two Utah counties, meaning it likely serves a substantial patient population.
• Class action attorneys have already announced an investigation, citing the potential for patient data to have been compromised.

What remains unconfirmed includes the specific categories of protected health information involved, the number of individuals affected, whether any ransom demand was made or paid, and whether Tanner Clinic has begun internal breach analysis under its incident response plan.

Compliance officers and legal counsel should treat the gap between the alleged attack date (October 28) and the public claim (November 12) as a signal. That two-week window may reflect the time the group spent preparing data for publication, negotiating with the victim, or both. It does not necessarily reflect when Tanner Clinic first became aware of the incident.

INC Ransom and the Healthcare Targeting Pattern

INC Ransom is not a new or obscure actor. The group has been observed targeting healthcare providers as part of a broader pattern of double extortion attacks, where data is exfiltrated before systems are encrypted. This tactic is particularly damaging in healthcare because it separates the encryption problem from the data exposure problem. Even if a covered entity restores systems from clean backups quickly, the exfiltrated data is already out of the organization's control.

Multispecialty outpatient groups are a recurring target category in ransomware attacks. They tend to hold diverse, sensitive records including diagnoses, treatment histories, insurance information, and in many cases behavioral health or other highly sensitive data. They also frequently operate with leaner IT and security teams than large hospital systems, making them attractive targets relative to the volume of data they hold.

HIPAA Obligations That Apply If the Breach Is Confirmed

If Tanner Clinic's investigation determines that protected health information was accessed or acquired by an unauthorized party, the organization's obligations under the HIPAA Security Rule and Breach Notification Rule will be triggered.

Under the Security Rule, covered entities are required to implement reasonable and appropriate safeguards to protect electronic protected health information. 45 CFR §164.306 This includes administrative, physical, and technical safeguard requirements that apply to any organization handling ePHI.

The Breach Notification Rule requires covered entities to notify affected individuals without unreasonable delay and no later than 60 days following discovery of the breach. 45 CFR §164.404 If the breach affects 500 or more residents of a state or jurisdiction, the covered entity must also notify prominent media outlets in that state. 45 CFR §164.406 HHS must be notified as well, with the same 60-day deadline applying to breaches of 500 or more individuals. 45 CFR §164.408

The 60-day clock runs from the date of discovery, not the date the threat actor chose to publicize the claim. If Tanner Clinic discovered suspicious activity on or around October 28, that date may be the starting point for calculating notification deadlines, regardless of when the public became aware.

One important nuance: under HIPAA, an impermissible acquisition of PHI is presumed to be a breach unless the covered entity can demonstrate through a risk assessment that there is a low probability that the PHI has been compromised. 45 CFR §164.402 A ransomware group's public posting of a claim that it exfiltrated data makes that low-probability demonstration extremely difficult to sustain.

The Class Action Dimension

The rapid pivot to class action investigation is not unusual in ransomware cases involving healthcare providers, but it deserves specific attention here because it illustrates how quickly the legal exposure compounds.

Plaintiff attorneys monitor ransomware leak sites and public breach disclosures closely. When a healthcare organization appears on a threat actor's site, law firms begin identifying potential class representatives among patients who may have been affected. By the time a covered entity has completed its forensic investigation and issued breach notifications, a class action complaint may already be in progress.

For multispecialty outpatient groups operating across multiple counties, the patient population can be substantial. A larger affected population generally means greater potential damages in class action litigation, as well as more complex and costly notification and remediation processes.

Compliance officers should flag this dynamic when briefing leadership. The legal risk in a ransomware incident does not begin at notification. It can begin the moment a threat actor publishes a claim, well before the covered entity has characterized the incident internally.

What Compliance Officers Should Do Right Now

If you are a compliance officer, practice manager, or healthcare SaaS founder whose organization interfaces with Tanner Clinic as a business associate, or if you are simply benchmarking your own incident response posture against this event, consider the following:

Review your incident response plan. Specifically, confirm that your plan accounts for the scenario where a threat actor publicizes a claim before your internal investigation is complete. Know how your organization communicates with patients, regulators, and legal counsel in that window.

Confirm your breach notification timeline tracking. The 60-day clock under 45 CFR §164.404 is firm. If your organization has experienced suspicious activity that has not yet been fully analyzed, that clock may already be running.

Assess your business associate relationships. If Tanner Clinic is a covered entity that handles PHI on behalf of or in conjunction with your organization, review your Business Associate Agreement and understand your obligations and rights in the event of a confirmed breach on their end. 45 CFR §164.314

Do not rely on a covered entity's silence as a clearance signal. The absence of a public statement from Tanner Clinic as of November 13, 2026 does not mean this incident will not result in a formal breach notification or regulatory inquiry.