Arkansas Primary Care Clinic, PA, a primary-care medical practice in Little Rock, Arkansas, suffered a ransomware attack in late April 2025 carried out by the INC Ransom ransomware-as-a-service group. The attackers claimed to have exfiltrated approximately 15 gigabytes of data before deploying ransomware on the clinic's systems. INC Ransom listed the practice on its dark-web leak site and threatened to publish the stolen data unless ransom demands were met. The breach was indexed by breach-tracking services in early July 2025.

The breach affected approximately 26,000 individuals based on records indexed by breach-tracking services. Compromised fields included Social Security numbers, email addresses, phone numbers, and home addresses. As a primary-care clinic, the underlying records exfiltrated by the attackers also include patient identity, insurance, billing, clinical, diagnostic, and treatment information typical of a long-term primary-care relationship, beyond the more limited field set surfaced publicly.

For affected patients, the practical risk profile combines identity-fraud exposure with primary-care-specific risks. The combination of name, address, and Social Security number is a strong base for synthetic identity fraud and fraudulent credit applications. Inclusion in the dataset confirms a primary-care relationship that often spans years of medical records and may include sensitive diagnoses, prescription histories, and insurance information. Patients should treat unsolicited contact referencing Arkansas Primary Care or any past primary-care visit with caution. Affected individuals should freeze credit at all three U.S. bureaus, monitor health-insurance statements for unfamiliar charges, and remain alert to phishing attempts referencing real medical history details that may have been included in the stolen archive.

Primary care clinic networks collect patient identity, contact, insurance, billing, appointment, and clinical records across routine medical-service workflows.

Arkansas Primary Care was attacked by the INC Ransom ransomware group in late April 2025. The attackers claimed to have exfiltrated approximately 15 GB of data before deploying ransomware on the clinic's systems and subsequently listed the practice on the INC Ransom dark-web leak site. The breach was indexed by breach-tracking services in early July 2025. Class-action investigations by U.S. plaintiff law firms began organizing in mid-2025 following the initial disclosure. INC Ransom has been an active ransomware-as-a-service operation throughout 2024 and 2025 with multiple healthcare-sector victims, including Mount Rogers Community Services Board.