TriCity Family Services
bd_531300798c3fe503 · schema v1 · pii pii-v1
Full breach record for TriCity Family Services →Threat-actor claim — not a regulatory filing
This row is a claim by the ransomware group INC Ransom on its public extortion blog. It has not been validated by the victim or any regulator. Treat attribution and counts as the threat actor's assertion until a regulatory filing or victim disclosure corroborates them.
Source: Ransomware.live
Post text · scraped from the leak site
TriCity Family Services (TCFS) is the leading provider of counseling and mental health services in Kane County, catering to clients of all ages and income levels. The organization offers a wide range of services including family-based treatment for eating disorders, emotional wellness programs, workshops, support groups, and employee assistance programs. With a mission to provide accessible and affordable mental health care, TCFS serves over 4,000 clients each year, accepting most major insurance plans and offering fee adjustments as needed. Established in 1967, TriCity Family Services is committed to supporting individuals and families in their journey toward emotional wellness.
J jump to incidentP pin to compareR raw source
Incident timeline — mostly unverified
? — ?
Breach window unknown
Mar 26, 2025
Claim posted
—
Corroborated · see linked filings
Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.
Claim → filing
—
Compliance clock
Not assessable
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- Illinois State AGbd_3db08bdf2a9b6c182025-12-01 · +250dCandidate
- HHS OCRbd_dccd64d2aeffb0762025-12-08 · +257dVerified by operator
Filing propagation · 3 filings
View merged incident ↗Pattern: first filing Mar 26, last Dec 8 (IL) — a 257-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?
Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.
Source ceiling
- actor name
- victim claim
- ransom/leak status
- discovery date
- materiality
- notification
- affected count
- confirmed data types
- compliance clock
The ✕ fields stay blank until a regulatory filing or victim disclosure lands.