On January 8, 2026, the Committee to Protect Journalists (CPJ) appeared on the leak site operated by the Clop ransomware group, with the attackers claiming to have exfiltrated internal files from the New York-based nonprofit.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Watch Cpj.Org
Get alerted the next time Cpj.Org files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about Cpj.Org’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
What Public Reporting Shows
Public reporting indicates that CPJ, an organization dedicated to defending press freedom and documenting threats against journalists worldwide, was listed by Clop after a ransomware incident. The group posted evidence on its dark-web leak portal, accessible via the .onion link hosted on ransomware.live. Available reporting describes the exposed material as internal files, though the exact volume and full contents remain unclear. No confirmed victim count has been released, and CPJ has not yet issued a detailed public statement on the scale of the breach. The incident follows Clop’s established pattern of targeting organizations and then pressuring them by threatening to publish stolen data.
Why This Matters for You and Your Family
When a respected nonprofit like CPJ is hit, the data it holds can include contacts, donor records, journalist safety assessments, and internal correspondence. If any of that information overlaps with your own details — perhaps through a donation, a tip you submitted, or an email address shared in the course of your work — those records can surface in unexpected places. Internal files often contain names, addresses, phone numbers, and notes that feel harmless until they are combined with other leaks. For ordinary people and their families, this means another vector for spam, phishing, or more targeted harassment that can escalate quickly once the information leaves controlled hands.
The Doxxing and Identity-Chain Risks
Ransomware leaks rarely stop at one dataset. Attackers and subsequent opportunists frequently cross-reference newly exposed material with earlier breaches, creating long identity chains that link an email address to a username, a phone number, a home address, and eventually to family members. A single credential leak from an organization like CPJ can cascade into gaming account takeovers, especially for children whose usernames and shared family emails appear in the same datasets. Once those connections are mapped, doxxing becomes straightforward: real names, locations, and personal details are assembled and published or sold. This is precisely why continuous monitoring across massive breach repositories is essential — it catches the secondary and tertiary exposures that follow the initial leak.