evergreenpnw.com Listed by incransom Ransomware Group

On January 22, 2025, the ransomware group Incransom added evergreenpnw.com to its leak site and published proof of exfiltration containing 63,846 internal files totaling more than 32 GB from Evergreen Christian Community, a religious organization headquartered in Olympia, Washington.

What's Publicly Reported from Reporting

Public reporting indicates the victim is a nonprofit employer of 100 to 249 people with annual revenue between $10 million and $25 million. The data set listed on the Incransom blog includes directories and files that appear to contain internal business records. No specific count of individuals whose personal information was taken has been released. The leak site entry shows both the volume of stolen data and remaining free space on what was presumably an internal server.

Available details list two phone numbers tied to the organization: the main line (360) 352-3410 and an IT director contact (360) 528-7385. The incident follows the group’s standard pattern of stealing files before encrypting systems and later posting samples as leverage for payment.

Why This Matters for You and Your Family

When a community organization like a church or nonprofit suffers a breach, the people connected to it often have their personal information exposed. If you or your family attend Evergreen Christian Community, volunteer there, or are listed as donors, staff, or vendors, your details may now sit in a ransomware actor’s archive. Names, addresses, phone numbers, and email records are common in such file dumps and can be sold or published without warning.

Even if you are not directly affiliated, these incidents remind us that everyday institutions we trust with our information remain targets. One breach can ripple outward, placing your family’s contact details, financial notes, or correspondence into circulation on criminal forums.

The Doxxing and Identity-Chain Risk

Stolen internal files frequently contain spreadsheets that link names to addresses, phone numbers, email accounts, and sometimes dates of birth or family member references. Attackers combine this information with data from previous breaches to build detailed profiles. A single leaked church directory can anchor an identity chain that connects your work email, personal phone, and children’s activity registrations.

Credential leaks like this one cascade into account takeovers and doxxing chains, especially when gaming accounts are involved. Children’s usernames or parent-linked emails reused across platforms become entry points for harassment or further extortion once the initial data appears on leak sites.

Incransom’s Publicly Known Track Record

Public reporting attributes the Incransom group with operating a double-extortion model: encrypt victim systems, exfiltrate files, then threaten to publish the data unless a ransom is paid. The group emerged in recent years and has targeted organizations across multiple sectors, posting victim names and sample files on its dark-web blog when payments are not received. Its typical playbook involves initial access through common vulnerabilities or phishing, followed by broad data collection and a public countdown to increase pressure on the victim.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real-world identity so you can see exactly what this leak connects to.
• Rotate any password you used at evergreenpnw.com or related church systems anywhere it has been reused, and switch on 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your information is caught in hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and your children’s gaming accounts, which often chain back to the same addresses or parent emails.
• Let remediation specialists handle takedown requests and broker removals for you while you focus on securing accounts and talking with your family about protecting personal details.

The pace of ransomware leaks shows no sign of slowing, which means families must treat every exposed organization as a potential source of their own future risk. Starting with a clear map of where your information already appears online gives you the best chance of staying ahead of the next incident. DoxxScan by GalaxyWarden delivers that continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that connects handles to real identities, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts.