Grace Church International Listed by medusa Ransomware Group

On January 11, 2023, Grace Church International appeared on the leak site operated by the Medusa ransomware group. The church, which describes its beliefs around biblical authority, prayer, faith, and family as the foundation of its mission, is claimed to have had internal files exfiltrated during a ransomware attack. The listing does not specify the number of people affected or detail the exact volume or types of documents stolen beyond claiming that internal files were taken.

Details from the Leak Site

The primary disclosure on the Medusa leak site states that Grace Church International suffered a ransomware incident in which attackers exfiltrated internal files. No specific victim count is provided, and the listing does not quantify the records involved. The disclosure indicates the data was obtained through a ransomware deployment, with the threat actors now using the leak site to pressure the organization. Public reporting on Medusa ransomware incidents consistently shows that when initial ransom demands are ignored, groups publish samples or full datasets to escalate the extortion.

Why This Matters for You and Your Family

Even though Grace Church International is a religious organization, many churches maintain detailed records on congregants, donors, staff, and volunteers. If your name, address, phone number, email, date of birth, or financial details were part of those internal files, this claimed breach puts your personal information in the hands of criminals. Families who attend or support the church may find that information sold on underground forums or used to launch targeted phishing, identity theft, or harassment campaigns. The exposure is particularly concerning because church databases often link multiple family members together, creating a single point of failure that can affect spouses, children, and extended relatives at once.

Doxxing and Identity-Chain Risks

Internal files from organizations like churches frequently contain not just names and contact details but also notes, schedules, prayer requests, and correspondence that reveal personal relationships and routines. Attackers can chain this data with information from other breaches to build detailed profiles. A leaked email or phone number from this incident can be cross-referenced with gaming usernames, social-media handles, or school records, rapidly turning a simple data leak into full doxxing. Once attackers map these connections, they can hijack accounts, impersonate victims, or extort individuals directly. Credential leaks of this nature often cascade into gaming account takeovers, especially for children and teenagers whose usernames and passwords may be reused across church-related logins and online games.

Medusa Group's Known Track Record

Public reporting attributes the emergence of the Medusa ransomware group to mid-2021. Since then the group has targeted organizations across sectors, including healthcare providers, educational institutions, and nonprofits. Notable prior victims have included municipal governments and manufacturing companies, though exact lists fluctuate as new incidents are claimed. Medusa's typical playbook involves gaining initial access through phishing or exploited remote desktop protocols, followed by lateral movement to exfiltrate sensitive files before deploying ransomware. The group then demands payment and, if unpaid, publishes data on their leak site with countdown timers. This dual extortion approach — ransom plus data leak — has become their standard method for pressuring victims.

What to do

• Run a DoxxScan to map every link between your email addresses, phone numbers, family names, and online handles that may have been exposed in the Grace Church International files.
• Rotate any password you used for church portals, donation sites, or related logins, and enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your information is caught and addressed in hours, not months.
• Cover the household with DoxxScan family coverage that includes dependents and children's gaming accounts, which often chain back to the same addresses or parent emails leaked in incidents like this.
• Let remediation specialists handle takedown requests for any exposed personal documents or broker listings tied to the breach.

The incident underscores how even community-focused organizations can become gateways for identity compromise that reaches far beyond their walls. Staying ahead requires more than reactive checks. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and over 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with household coverage that explicitly protects children's gaming accounts from cascading takeovers. Source: https://www.ransomware.live/id/R3JhY2UgQ2h1cmNoIEludGVybmF0aW9uYWxAbWVkdXNh