Goodwill Listed by interlock Ransomware Group

On March 26, 2026, Goodwill Industries of North Central Pennsylvania appeared on the leak site of the interlock ransomware group. The nonprofit, which provides job training and employment for more than 700 people across 15 counties in Pennsylvania and one county in New York, is claimed to have had internal files exfiltrated during a ransomware attack. Hundreds of pieces of personal data belonging to employees and partners, along with financial documents, were posted online.

Reported Details of the Breach

Public reporting indicates the incident involved the theft of internal files rather than a mass compromise of customer databases. Available reporting describes the exposed material as including personal information of current and former employees as well as partners. No precise victim count has been released by the organization or the attackers. The data appeared on the interlock ransomware group’s leak site, which is accessible via the Tor network.

Internal files and financial documents were among the material published. The breach highlights how even regional nonprofits handling employment records can become targets when basic security controls lag behind the threats.

Why This Matters for You and Your Family

When an employer or partner organization like Goodwill suffers a breach, your personal details can end up exposed even if you never shopped there. Employment records often contain Social Security numbers, addresses, dates of birth, and direct-deposit information. Once that data reaches the public internet, it can be used to file fraudulent tax returns, open accounts in your name, or fuel more sophisticated attacks against you and your family.

Children’s information sometimes appears in these files too, through dependent records or family health benefits. A single leak can therefore place every member of your household at elevated risk for identity theft that may not surface for months or years.

The Doxxing and Identity-Chain Risks

Leaked employment files frequently contain email addresses, usernames, or phone numbers that attackers link to your other online accounts. Public reporting shows these credential leaks often cascade into gaming-platform takeovers, especially for children’s accounts that reuse the same password or recovery email. Once an attacker controls one account, they map additional handles, locations, and relationships, building a complete identity chain that leads to doxxing, harassment, or further extortion.

Credential leaks like this one rarely stay isolated. They become the starting point for automated tools that test the same passwords across dozens of services, turning a workplace breach into a household problem.

Interlock Ransomware Group’s Track Record

Public reporting attributes the attack to the interlock ransomware group. The group emerged in late 2024 and has since listed dozens of organizations on its leak site. Notable prior victims include mid-sized manufacturers, healthcare providers, and other nonprofits. Their typical playbook begins with initial access through phishing or unpatched remote desktop services, followed by exfiltration of sensitive files and deployment of ransomware. If payment is not made, interlock publishes samples of the stolen data and threatens full release, using the leak site as both extortion tool and public shaming mechanism.

What to Do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by the service.
• Rotate the password used at Goodwill anywhere it is reused and enable 2FA through an authenticator app rather than text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure is caught in hours, not months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same credentials.
• Let DoxxScan remediation specialists manage takedown requests across data brokers and exposed records on your behalf.

The incident at Goodwill Industries of North Central Pennsylvania shows how quickly workplace data can become public and why waiting for notification is no longer enough. Start your DoxxScan trial today and combine continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full family coverage including children’s gaming accounts. Taking these steps now limits the damage from this claimed breach and reduces the impact of the next one.