NBS Canada Listed by sinobi Ransomware Group

On December 18, 2025, the Network of Biblical Storytellers Canada appeared on the leak site of the sinobi ransomware group. Internal files were allegedly exfiltrated during a ransomware attack on the nonprofit organization, which supports biblical storytelling workshops, festivals, and resources across Canada.

What's Publicly Reported from Reporting

Public reporting indicates that sinobi listed NBS Canada on its dark web leak page and claims to have stolen internal documents. The exact number of people whose information is contained in the files remains unknown. No sample data has been publicly released by the group to verify the claims.

The organization itself is a nationwide Canadian association focused on teaching people to tell Bible stories from memory. Its activities include workshops, the annual Festival of Biblical Telling, and resources for both individual storytellers and churches.

Why This Matters for You and Your Family

When a nonprofit like NBS Canada suffers a breach, the exposed files can contain names, addresses, email addresses, phone numbers, and donation records of ordinary people who attended events, volunteered, or supported the ministry. Internal files exfiltrated often include exactly the kind of personal details that identity thieves and harassers look for.

Even if you are not deeply involved with the group, friends or family members who have attended a storytelling festival or signed up for a workshop may now have their contact information circulating in criminal circles. Once that data leaves the organization’s control, it can appear on multiple marketplaces and forums within weeks.

The Doxxing and Identity-Chain Implications

Ransomware leaks rarely stop at one set of records. A single email or phone number allegedly taken from NBS Canada’s files can be cross-referenced with gaming accounts, social-media handles, and other breaches to build a complete picture of you and your household. This process, known as identity chaining, turns one leak into a roadmap for targeted harassment, account takeovers, or financial fraud.

Credential leaks like this one frequently cascade into gaming account compromises. Children’s accounts linked to a parent’s email are especially vulnerable because the same password or recovery details often protect both family email and online game logins.

Sinobi Group’s Known Track Record

Public reporting attributes the sinobi ransomware operation to a group that emerged in 2024. The gang has claimed responsibility for attacks on various organizations, typically small-to-medium businesses and nonprofits. Their standard playbook involves gaining initial access, exfiltrating data before encryption, and then publishing samples on their leak site when victims refuse to pay the demanded ransom. Extortion pressure is applied through both data exposure threats and, in some cases, direct contact with affected individuals.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity so you can see exactly what this leak connects to.
• Rotate any password you used for NBS Canada accounts or newsletters anywhere else it is reused, and switch to 2FA through an authenticator app rather than text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information surfaces you learn about it within hours instead of months.
• Cover the household with DoxxScan family protection that includes dependents and children’s gaming accounts, which often chain back to the same family address or parent email.
• Let remediation specialists handle the follow-up work of sending takedown notices to data brokers and monitoring for reappearance of the stolen records.

The incident shows how quickly a single organization’s security lapse can ripple outward to affect supporters and their families. Taking concrete steps now limits how far that ripple travels. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that connects scattered online handles to real identities, and hands-on remediation by specialists who manage takedowns for you. Its household coverage extends to children’s gaming accounts that are frequently targeted once credential leaks like this one occur.