Habitat for Humanity of Greater Sioux Falls, Inc. Listed by qilin Ransomware Group

On May 9, 2025, Habitat for Humanity of Greater Sioux Falls appeared on the leak site of the qilin ransomware group. The nonprofit, which helps families in the Minnehaha County area obtain affordable housing, had internal files stolen during a ransomware attack. While the exact number of people whose information was taken remains unknown, any donor, volunteer, employee, or program participant who provided personal details could be affected.

What Public Reporting Shows

Public reporting indicates that qilin actors exfiltrated internal files from the organization’s systems before encrypting them. The data includes documents that typically contain names, addresses, contact information, financial details tied to donations or program applications, and other records used in daily operations. No precise count of exposed records has been released, and the organization has not yet issued a public statement detailing the scope. The listing on the qilin leak site carries a deadline for payment or further data publication, a standard pressure tactic used by the group.

Why This Matters for You and Your Family

When a local nonprofit like Habitat for Humanity suffers a breach, the impact reaches ordinary families who trusted the organization with sensitive information. Addresses, phone numbers, email accounts, and financial records can be sold or published, increasing the risk of identity theft, targeted phishing, or unwanted solicitations. If you or your family have ever applied for housing assistance, volunteered, or made a donation, your information may now sit in an attacker’s database. Children’s names or school-related details sometimes appear in nonprofit files as well, creating long-term exposure that parents must address.

The Doxxing and Identity-Chain Implications

Stolen internal files rarely stay isolated. Attackers combine them with data from earlier breaches to build detailed profiles. A single address or email can link gaming usernames, social-media handles, and family relationships, turning one leak into a chain of doxxing risks. Credential leaks like this one often cascade into account takeovers on gaming platforms, where children’s accounts become entry points for further harassment or extortion. Public reporting shows these chains frequently lead to swatting attempts, identity fraud, or relentless spam directed at home addresses that were meant to stay private.

Qilin’s Publicly Known Track Record

Public reporting attributes the attack to the qilin ransomware group, which emerged in 2022. The group has targeted hospitals, schools, local governments, and nonprofits across multiple countries. Its typical playbook involves initial access through phishing or exploited remote desktop protocols, followed by exfiltration of sensitive files, deployment of ransomware, and publication of samples on a leak site if the victim does not pay. Qilin often uses double-extortion tactics—threatening both data encryption and public release—to pressure organizations into meeting demands.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, addresses, and online handles that may have surfaced in this or earlier breaches.
• Rotate any password you used at Habitat for Humanity of Greater Sioux Falls anywhere else it is reused, and switch to 2FA through an authenticator app instead of text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure is caught and addressed in hours rather than months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often chain back to the same address or parent email.
• Let remediation specialists handle takedown requests across data brokers and leak sites so you do not have to negotiate directly with threat actors or shady removal services.

The incident underscores that even community-focused organizations can become targets, leaving ordinary families exposed without warning. Taking concrete steps now limits how far attackers can travel down the identity chain. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Start your DoxxScan trial today to regain control of your information before the next leak appears.