mysfa.org Listed by INC Ransom Ransomware Group

On March 13, 2025, the Incransom ransomware group listed mysfa.org on its leak site and began publishing internal files allegedly stolen from St. Francis Advocate, a nonprofit that supports adults and youth with developmental disabilities across Sarnia-Lambton, Chatham-Kent, and Windsor-Essex.

What Public Reporting Shows

Available reporting describes an active ransomware incident in which Incransom claims to have exfiltrated internal files from the organization, which has operated since 1984 and runs 13 supported group living homes. The precise number of individuals whose information appears in the stolen files remains unknown. Public reporting indicates the data includes records tied to the nonprofit’s residential programs, supported independent living services, and youth transition initiatives. No confirmed timeline for the initial breach has been released, though the group posted the listing on its leak site on March 13, 2025.

Why This Matters for You and Your Family

When a community organization like St. Francis Advocate is hit, the people who rely on its services — and their families — can find their personal details exposed. Internal files often contain names, addresses, dates of birth, contact information, medical or support details, and sometimes family member records. Once that information leaves secure systems, it can be sold, traded, or used to target you with identity theft, phishing, or harassment. Even if you are not the primary client, your data may appear as a parent, guardian, emergency contact, or household member. The breach therefore reaches beyond the organization’s walls and directly into the lives of ordinary families who trusted SFA with sensitive information.

The Doxxing and Identity-Chain Implications

Stolen internal files frequently link real names and addresses to email accounts, phone numbers, and online handles. Attackers can follow these connections to gaming platforms, social media, and other services where your family maintains accounts. A credential leak from one system often cascades into account takeovers elsewhere, especially when the same password has been reused. Children’s gaming accounts are particularly vulnerable because they are sometimes registered with a parent’s email or tied to the family address. Public reporting on similar incidents shows that these chains can lead to doxxing, where private details are published alongside usernames, making targeted harassment or further extortion easier. The longer the gap between the breach and discovery, the more time criminals have to map and exploit these links.