First Baptist Church of Hammond Listed by Rhysida Ransomware Group

On July 29, 2025, the First Baptist Church of Hammond appeared on the leak site of the Rhysida ransomware group. The Indiana church, established in 1887 and once ranked the 12th largest in America, is claimed to have had internal files exfiltrated during a ransomware attack. Anyone connected to the church — members, staff, donors, or families whose information appears in its records — may now face heightened risk of identity theft and doxxing.

Reported Details of the Incident

Public reporting indicates that Rhysida listed the church on its dark-web leak portal and began publishing what it claims are stolen internal documents. The exact number of people affected remains unknown because the church has not released a formal statement detailing the breach scope. Available reporting describes the exposed material as internal files rather than a single structured database of member records. No specific deadline for ransom payment has been publicly confirmed in connection with this listing.

Why This Matters for You and Your Family

Churches routinely hold sensitive personal information: full names, home addresses, phone numbers, email addresses, dates of birth, family relationships, and sometimes Social Security numbers for staff or donation processing. When those records leave secure systems, they become raw material for identity thieves, phishing campaigns, and harassment. Internal files exfiltrated can include everything from membership directories to financial ledgers, instantly exposing hundreds or thousands of ordinary families who never expected their place of worship to become a target.

If your data or your children’s data was among the stolen files, the consequences can appear months later — unexpected credit-card charges, loan applications in your name, or strangers contacting you with details only an insider should know.

The Doxxing and Identity-Chain Risks

Stolen church records rarely stay isolated. A single email or phone number can be cross-referenced with gaming accounts, social-media handles, and public records to build a complete picture of your household. Attackers chain these fragments together, turning one breach into repeated targeting. Credential leaks like this one frequently cascade into account takeovers on unrelated services where the same password was reused. Gaming accounts belonging to you or your children are especially vulnerable because they often share the same email address listed in family church records, creating a direct path from ecclesiastical data to live harassment or extortion.

Rhysida’s Publicly Known Track Record

Public reporting attributes the Rhysida ransomware group with emerging in 2023. The group has claimed responsibility for attacks on hospitals, schools, municipalities, and nonprofit organizations. Its typical playbook involves gaining initial access, exfiltrating data before encrypting systems, then publishing samples on its leak site to pressure victims into payment. Extortion demands usually combine threats of data release with offers to delete the stolen material upon ransom. Exact success rates and prior victim counts for Rhysida remain difficult to verify independently, but its appearance on standard ransomware trackers shows it maintains an active operation.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup of Warden to remove what you can.
• Rotate any password you ever used at the church or related services, and switch on 2FA through an authenticator app rather than text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your information is caught in hours instead of months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that chain back to the same address or email.
• Let remediation specialists handle takedown requests across data brokers and exposed profiles while you focus on securing your own accounts.

The incident shows that even long-established community institutions can be hit without warning, leaving ordinary families to manage the aftermath. A short forward-looking step is to treat every service that holds your data as a potential leak source and act before criminals connect the dots. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that links scattered handles to real identities, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Starting that process now can limit the damage from both this claimed breach and the ones that have not yet been discovered.