npfy.org Listed by incransom Ransomware Group

On March 31, 2025, the nonprofit New Pathways for Youth in Phoenix, Arizona, appeared on the leak site of the ransomware group Incransom. The organization, which serves vulnerable young people through mentoring programs, had internal files exfiltrated during a ransomware attack. Public reporting indicates that the number of individuals whose information may have been exposed remains unknown.

What's Publicly Reported from Reporting

Available reporting describes New Pathways for Youth as a $5 million organization with 33 employees focused on helping Phoenix students graduate high school and pursue further education. The group Incransom listed the nonprofit on its public leak site on March 31, 2025, claiming to have taken internal files. No specific details about the volume or exact nature of the stolen data have been publicly confirmed beyond the broad description of internal files.

The incident follows the typical pattern in which ransomware operators first encrypt systems, then threaten to publish stolen data unless a ransom is paid. Public reporting attributes the posting to Incransom’s standard disclosure process.

Why This Matters for You and Your Family

When a youth-serving nonprofit suffers a breach, the information exposed can include details about program participants, donors, staff, and their families. Even if you have never directly interacted with New Pathways for Youth, these incidents highlight how data from organizations that serve children and families can enter criminal networks. Internal files often contain names, addresses, dates of birth, contact information, and sometimes financial or employment records.

Once that information reaches dark web marketplaces, it becomes raw material for identity theft, phishing campaigns, and harassment directed at ordinary people. Your family’s safety depends on recognizing that even organizations with the best intentions can become gateways for criminals to reach you.

The Doxxing and Identity-Chain Implications

Stolen internal files frequently contain email addresses, usernames, or phone numbers that link together. Criminals use these connections to build detailed profiles, moving from one piece of information to another until they can locate addresses, family members, or even children’s online gaming accounts. A single leaked email can expose associated handles used on social media or gaming platforms, creating a chain that leads to doxxing.

Credential leaks like this one cascade into account takeovers when the same password has been reused elsewhere. Gaming accounts belonging to you or your children are particularly vulnerable because they often share credentials with email or school-related logins. Once an attacker controls a gaming account, they can harvest additional personal details or use it as a stepping stone to further harassment.

Incransom’s Publicly Known Track Record

Public reporting attributes Incransom with emerging in recent years as a ransomware operation that combines encryption with data-theft extortion. The group has targeted organizations across multiple sectors, typically gaining initial access through common methods such as phishing or exploiting remote desktop vulnerabilities. After exfiltrating data, Incransom follows a standard playbook of publishing samples on its leak site and demanding payment to prevent full disclosure.

The group’s activities are tracked by multiple ransomware intelligence platforms. Its exact victim count is difficult to verify, but public listings show a pattern of hitting mid-sized organizations, including those in the nonprofit and education spaces where sensitive youth and family information is common.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real-world identity so you can see exactly what chains exist from this type of breach.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time one of your details appears it is caught and addressed within hours rather than months.
• Rotate any passwords used at New Pathways for Youth or similar organizations anywhere else you have reused them, and switch to 2FA through an authenticator app instead of text messages.
• Cover your entire household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often become targets when credential leaks create doxxing chains.
• Let remediation specialists handle the ongoing work of submitting takedown requests to data brokers and monitoring for reappearance of your family’s information.

The reality is that breaches at organizations serving children will continue. Protecting your family requires more than hoping your information stays out of the wrong hands. Start your DoxxScan trial and use its continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and family coverage including children’s gaming accounts. One organization’s security failure does not have to become your family’s ongoing risk.