Canvas Church Listed by qilin Ransomware Group

Canvas Church appeared on the qilin ransomware group’s leak site on December 6, 2025, after the organization’s internal files were allegedly exfiltrated. The listing means that anyone whose personal information was stored in those systems — including members, donors, staff, and their families — may now face heightened risk of identity theft, phishing, or doxxing.

What Public Reporting Shows

Public reporting indicates that qilin posted Canvas Church to its data-leak portal and claims to have stolen internal documents. Available details list the exposure as internal files with no confirmed count of affected individuals. The church has not yet issued a public statement confirming the volume or exact nature of the stolen data. Industry research from sources such as DoxxScan™ continuous monitoring has not yet catalogued this incident, which is typical for fresh ransomware leaks.

Why This Matters for You and Your Family

When a church’s internal files are taken, the information often includes names, addresses, phone numbers, email accounts, donation records, and sometimes dates of birth or family member details. That data can be sold or published within days. For ordinary families, the consequences are immediate: unexpected spam, targeted scams pretending to come from the church, or thieves piecing together enough to attempt account takeovers on personal email, banking, or social media. Children’s information, if present in youth-group records, can also enter the same underground markets.

The Doxxing and Identity-Chain Implications

Ransomware leaks rarely stop at one dataset. Attackers or buyers frequently combine the newly exposed church records with other breaches to build detailed profiles. A single email address from the Canvas Church files can link to your gaming username, your child’s Roblox or Fortnite account, and your home address. These identity chains let criminals harass families, hijack accounts, or demand payment to stop further exposure. Credential leaks like this one routinely cascade into gaming-account takeovers because the same passwords are reused across church portals, email, and game services.

Qilin’s Publicly Known Track Record

Public reporting attributes the attack to the qilin ransomware group. The group emerged in 2022 and has since targeted organizations across healthcare, education, manufacturing, and nonprofit sectors. Notable prior victims include hospitals and municipal governments whose data appeared on the same leak site. Qilin’s typical playbook involves initial access through phishing or exploited remote desktop credentials, followed by exfiltration of sensitive files and deployment of ransomware. The group then extorts victims by threatening to publish stolen data on its onion site if payment is not made. In cases where victims do not pay, qilin publishes samples and offers the full archive for sale to other criminals.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by the service.
• Rotate any password you used for Canvas Church systems anywhere it is reused, and switch on 2FA through an authenticator app rather than text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing you or your family is caught in hours, not months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same leaked address or email.
• Let remediation specialists perform hands-on takedown requests across data brokers and leak forums on your behalf.

The incident underscores that even organizations you trust with personal information can become gateways for identity abuse. Acting quickly on the credentials and links already circulating can limit damage before criminals stitch together a complete profile of your family. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and family coverage that includes children’s gaming accounts — giving ordinary families a practical way to interrupt those chains.