ccadm.org Listed by dispossessor Ransomware Group

On December 13, 2023, the Associated Catholic Charities of Baltimore (ccadm.org) appeared on the leak site of the Dispossessor ransomware group. The listing states that internal files were exfiltrated during a ransomware attack on the nonprofit organization founded in 1931 to support vulnerable families in Maryland.

Details in the Leak-Site Listing

The primary disclosure on the Dispossessor leak site states that data was taken from ccadm.org and is now published for anyone to download. The listing does not quantify how many records are involved, nor does it specify the exact types of internal files beyond describing them as exfiltrated corporate documents. No ransom demand figure or negotiation details are provided in the public posting. The disclosure indicates the organization was given a deadline to pay or face full publication of the stolen material, a standard pressure tactic used by this group.

December 13, 2023 marks the first public confirmation of the breach through the attacker’s own channel. The leak site continues to host samples and full archives, making the data permanently accessible to identity thieves, competitors, and opportunistic criminals.

Why This Matters for You and Your Family

If you or your family have received assistance from Associated Catholic Charities of Baltimore, your personal information may be among the internal files now circulating. Nonprofits like this one routinely collect names, addresses, dates of birth, Social Security numbers, financial details for aid applications, medical or counseling records, and family status information. Once these records leave the organization’s control, they become raw material for fraud, identity theft, and targeted scams against everyday people who sought help during difficult times.

The exposure creates immediate risk because the data was taken from systems that many assume are safe. Even though the victim count remains unknown, any single record can be combined with information from other breaches to build a complete profile of you or your relatives.

The Doxxing and Identity-Chain Risk

Internal nonprofit files often contain both direct identifiers and indirect clues that allow attackers to link disparate online accounts. An email address used to apply for aid can be matched to gaming usernames, social-media handles, or school accounts. This is exactly how doxxing chains form: one leaked record exposes a phone number that leads to a child’s Roblox or Minecraft account, which in turn reveals household addresses and family relationships. Credential leaks of this nature frequently cascade into account takeovers that affect every digital service tied to the same password or recovery details.

Public reporting on similar incidents shows that families who interacted with charitable organizations are later targeted with personalized phishing or extortion attempts once their full identity chain is mapped.

Dispossessor’s Known Track Record

Public reporting attributes the first activity of the Dispossessor ransomware group to mid-2023. The group has since listed dozens of organizations, focusing on mid-sized businesses, schools, and nonprofits. Their typical playbook begins with initial access through compromised credentials or vulnerable remote desktop services, followed by exfiltration of sensitive files before encryption. Rather than relying solely on ransomware deployment, Dispossessor emphasizes public shaming and data leaks to coerce payment. Notable prior victims include other U.S. community-service entities whose internal donor and client records were published in a similar fashion. The group’s leak site remains active and regularly updated, indicating an organized operation that shows no sign of slowing.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity so you can see exactly what chains back to the ccadm.org breach.
• Rotate any password you ever used at Associated Catholic Charities anywhere else it is reused, and switch to 2FA through an authenticator app instead of SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your data is caught and acted on within hours.
• Cover your entire household with DoxxScan family protection, which includes dependents and children’s gaming accounts that often become the next link in a doxxing chain.
• Let DoxxScan remediation specialists manage takedown requests for any exposed personal documents appearing on data-broker or leak sites.

The breach of Associated Catholic Charities demonstrates once again that data held by even the most well-intentioned organizations can suddenly appear on ransomware leak sites with little warning. Taking concrete steps now limits how far attackers can travel down your identity chain. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that explicitly protects children’s gaming accounts from cascading takeovers.