promises2kids.org Listed by qilin Ransomware Group

On June 24, 2024, the nonprofit organization promises2kids.org appeared on the leak site operated by the qilin ransomware group. The listing states that internal files were exfiltrated during a ransomware attack on the San Diego–based charity that supports thousands of current and former foster youth each year. The disclosure does not quantify how many individuals are affected, nor does it list the specific types of records stolen beyond claiming that internal files were taken.

Details from the Leak-Site Listing

The qilin leak site entry, first observed on June 24, 2024, indicates that promises2kids.org suffered a ransomware intrusion in which attackers successfully exfiltrated internal files before encrypting systems or demanding payment. The posting does not disclose the volume of data taken, the exact date of initial compromise, or the ransom amount sought. It simply presents samples of the allegedly stolen material as proof of access and warns that the data will be published if demands are not met. Public mirrors of the leak site, such as ransomware.live, preserve this original posting for verification.

Internal files exfiltrated is the only description of compromised material provided in the primary disclosure. No donor lists, client case files, employee records, or financial spreadsheets are explicitly named, leaving the full scope of exposure unknown at this time.

Why This Matters for You and Your Family

When a nonprofit that serves vulnerable children and families is breached, the people whose information ends up in the hands of criminals are often the very individuals the organization was created to protect. If you or your child has ever received services from Promises2Kids, volunteered, made a donation, or been listed as a reference, your personal details may now sit in an attacker-controlled archive. Even without exact record counts, the exposure of internal files typically includes names, addresses, dates of birth, Social Security numbers, contact information, and case notes that can be used for identity theft or targeted fraud.

Foster youth and their extended families are already at higher risk of financial abuse. A single leaked record can trigger months of cleanup, damaged credit, and emotional stress. The breach also affects employees, board members, and donors whose data may have been stored alongside client information.

Doxxing and Identity-Chain Risks

Ransomware operators rarely stop at posting a single compressed archive. Once internal files leave the victim’s network, they frequently appear in underground markets where brokers link disparate records into complete identity profiles. An email address from this claimed breach can be cross-referenced with gaming accounts, social-media handles, or school records to build a persistent dossier. Children’s names and dates of birth are especially dangerous because they enable long-term synthetic identity fraud that may not surface until the child reaches adulthood.

Credential leaks like this one cascade into account takeovers and doxxing chains that can expose gaming usernames, streaming profiles, and family photos. What begins as a nonprofit breach can quietly evolve into sustained harassment or financial exploitation months later when the data is repackaged and sold.

Qilin’s Publicly Known Track Record

Public reporting attributes the emergence of Qilin (also known as Agenda) to mid-2022. The group has since claimed responsibility for attacks on healthcare providers, educational institutions, municipalities, and nonprofits across multiple countries. Its typical playbook begins with phishing or exploitation of remote desktop services to gain initial access, followed by rapid lateral movement, data exfiltration, and deployment of custom ransomware. Qilin operators often combine encryption with extortion, threatening to publish sensitive files on their leak site if payment is not received within a short window. The group has shown willingness to target organizations that serve children and the public sector, suggesting they calculate that reputational pressure will encourage faster settlement.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real-world identity so you can see exactly what this claimed breach connects to.
• Rotate any password used at promises2kids.org anywhere else it is reused, and switch to 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your data is caught in hours, not months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same address or parent email.
• Let remediation specialists handle takedown requests across data brokers and extortion sites on your behalf while you focus on securing accounts.

The promises2kids.org breach is a reminder that even organizations dedicated to helping children can become unwilling gateways for identity theft. Taking concrete steps now limits how far attackers can travel down the identity chain created by this incident. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Start your DoxxScan trial today to regain control of your exposed information before criminals put it to use.