ecfa.org Listed by INC Ransom Ransomware Group

On August 02, 2026, the ransomware group Incransom listed the Evangelical Council for Financial Accountability (ECFA) on its leak site, claiming the organization was hit by a ransomware attack in which internal files were exfiltrated. The ECFA, which accredits more than 2,700 Christian churches and nonprofits across the United States, has not publicly confirmed the incident as of this writing.

Primary Disclosure Details

The leak-site listing states that internal files were exfiltrated during a ransomware attack. It does not specify the volume of data taken, the exact types of records involved, the number of individuals affected, or any ransom demand. According to the disclosure on the group’s onion site, the files are being held for potential release if the organization does not meet the actors’ demands. Because the primary source is the threat actor’s own leak page rather than an official notification from ECFA, a regulator, or a federal agency, this remains an unconfirmed claim. ECFA has issued no public statement acknowledging the incident.

Why This Matters for You and Your Family

When an accreditation body like ECFA is targeted, the potential exposure reaches far beyond the organization itself. Member churches, nonprofits, donors, board members, and staff often have sensitive personal and financial information stored in shared systems. If donor records, employee files, or correspondence containing names, addresses, Social Security numbers, bank details, or contribution histories were included in the exfiltrated material, your family’s information could now be in the hands of criminals. Even without exact numbers, the disclosure indicates that internal files were taken, creating real risk for anyone whose data touched ECFA’s accreditation, governance, or fundraising processes.

Doxxing and Identity-Chain Risks

Ransomware operators rarely stop at simple data theft. Once internal files leave an organization’s control, they frequently appear in underground markets where threat actors link disparate pieces of information into complete identity profiles. A single leaked email or phone number from an ECFA-related document can be chained with other breaches to reveal home addresses, family relationships, employment details, and financial habits. This is exactly how doxxing campaigns begin. Credential leaks of this nature also cascade into gaming accounts belonging to you or your children, where stolen passwords grant initial access that expands into full identity exposure. Continuous monitoring is essential because these chains often surface weeks or months after the initial leak.

Incransom’s Known Track Record

Public reporting attributes Incransom with emerging in late 2024 as a double-extortion ransomware operation. The group typically gains initial access through phishing, compromised remote desktop credentials, or exploited vulnerabilities in internet-facing applications. After exfiltrating data, they encrypt systems and then publish samples on their leak site to pressure victims into payment. Notable prior claims have included mid-sized enterprises and nonprofit-adjacent organizations. Their playbook relies on public embarrassment and the threat of full data dumps rather than immediate mass publication, giving victims a short window to respond before samples or full archives are released. As with most ransomware groups, these claims should be treated as allegations until independently verified.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real-world identity, including cleanup of exposed records.
• Enable continuous DoxxScan monitoring across 13.1 billion+ breach records and more than 100 platforms so the next exposure surfaces in hours rather than months.
• Rotate any password you have ever used with ECFA, its member organizations, or related church and nonprofit portals, then enable 2FA through an authenticator app instead of SMS.
• Cover your entire household with DoxxScan family protection, which extends to dependents and children’s gaming accounts that frequently chain back to the same addresses and identities.
• Let remediation specialists handle data-broker takedown requests and opt-out processes that would otherwise require dozens of manual submissions.

The speed with which ransomware claims turn into lasting identity exposure continues to rise. Treating every listing seriously and acting immediately remains the most practical defense for ordinary families. DoxxScan’s continuous monitoring, AI-powered identity-chain mapping, and hands-on remediation by specialists provide the ongoing protection needed in this environment, including coverage for both adult and children’s accounts that could otherwise become vectors for further compromise.