omf.org Listed by lockbit5 Ransomware Group

On December 24, 2025, the ransomware group LockBit5 added the missionary organization OMF International to its public leak site, claiming that internal files had been exfiltrated during a ransomware attack. The organization, a global Christian fellowship focused on East Asia, has not publicly disclosed the exact number of individuals whose information appears in the stolen data. Anyone whose personal details were stored in OMF’s systems could be affected, including supporters, donors, staff members, and their families.

What Public Reporting Shows

Public reporting indicates that LockBit5 listed OMF on its dark-web leak site on Christmas Eve 2025. The group claims to have obtained internal files and is using the threat of publication to pressure the organization. Available reporting describes the exposed material as internal documents rather than a structured database of customer records. No precise victim count has been released by either the attackers or OMF. The listing follows the group’s standard pattern of publishing a sample of stolen data while threatening to release the remainder if demands are not met.

Why This Matters for You and Your Family

When a nonprofit or ministry you support is breached, your personal information can end up in the hands of criminals. Internal files often contain donor addresses, phone numbers, email accounts, and sometimes financial details. Once that information leaves a trusted organization, it can be sold, traded, or used to target you directly. For families who give regularly or have deeper involvement, the exposure creates a permanent risk that grows every time another breach occurs. Children’s names or family details included in prayer lists or support records can also surface in unexpected places.

The Doxxing and Identity-Chain Implications

Stolen internal files frequently link real names to email addresses, phone numbers, and sometimes usernames used on other platforms. Attackers and data brokers can chain these pieces together to build a full profile. A single leaked email can lead to gaming accounts, social-media handles, and eventually home addresses. This is exactly how credential leaks cascade into account takeovers and doxxing campaigns. Public reporting shows that ransomware victims’ data often resurfaces months later on multiple underground marketplaces, expanding the attack surface for every person whose information was stored in the compromised systems.

LockBit5’s Publicly Known Track Record

Public reporting attributes the current attack to LockBit5, the latest iteration of the LockBit ransomware operation. The group first emerged in 2020 and has since targeted thousands of organizations worldwide, including hospitals, schools, and nonprofits. Notable prior victims include Boeing, the BBC’s internal systems, and numerous government agencies. Their typical playbook involves gaining initial access through compromised credentials or remote desktop vulnerabilities, exfiltrating data before encrypting systems, and then running a double-extortion campaign: demanding ransom to decrypt files and a second payment to prevent publication. LockBit5 continues to post victims on its leak site when payments are not made, often releasing additional samples to increase pressure.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup to remove what you can.
• Rotate the password you used for any OMF-related account anywhere it is reused, and switch on 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information appears it is caught in hours, not months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same family address or email.
• Let remediation specialists handle takedown requests across data brokers and suspicious sites on your behalf while you focus on securing your own accounts.

The incident shows that even organizations you trust can become unwilling gateways for your personal data to reach criminals. A forward-looking approach means treating every breach as a signal to lock down your digital footprint before the next one occurs. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with household coverage that includes your and your children’s gaming accounts. Starting that process now limits the damage from leaks that have already happened and reduces exposure to those still to come.