PSEC Church Listed by incransom Ransomware Group

On March 29, 2024, the Pennsylvania Southeast Conference of the United Church of Christ appeared on the leak site operated by the incransom ransomware group. The listing states that internal files were exfiltrated during a ransomware attack on the regional church body, which serves congregations across Philadelphia and its surrounding suburbs. Anyone connected to the conference—members, employees, donors, or vendors—may have personal information now in the hands of extortionists.

Details from the Leak Site

The incransom leak page, first indexed on March 29, 2024, claims the group obtained internal files after deploying ransomware against the Pennsylvania Southeast Conference. The posting does not quantify how many records were taken, list specific data types beyond “internal files,” or name the exact systems compromised. It follows the group’s standard format: an initial access announcement, followed by samples and a countdown to full publication if demands are not met. No ransom amount is disclosed on the public page.

Why This Matters for You and Your Family

Church conference records routinely contain names, addresses, phone numbers, email addresses, dates of birth, Social Security numbers, banking details for donations or payroll, and pastoral counseling notes. When such data leaves a nonprofit’s control, the exposure is personal. Families who attend affiliated churches, staff who work at conference offices, or volunteers whose background checks were filed centrally now face heightened risk of identity theft, phishing, and financial fraud. The disclosure indicates the data was taken; it does not state whether it has already been sold or shared on other forums.

Doxxing and Identity-Chain Risks

Church directories, internal spreadsheets, and email archives often link personal emails to home addresses, spouse names, and children’s names. Attackers can chain this information with handles from social media or gaming accounts to build complete profiles. A single leaked pastor’s spreadsheet can expose dozens of households. Credential material, if present, travels quickly from ransomware sites into broader criminal ecosystems, turning one breach into repeated account takeovers. DoxxScan by GalaxyWarden continuously monitors 13.1B+ breach records and 100+ platforms with AI-powered identity-chain mapping and hands-on remediation by specialists, including household coverage that extends to children’s gaming accounts vulnerable to the same credential cascades.

Incransom’s Known Track Record

Public reporting attributes incransom as a ransomware-as-a-service operation that emerged in late 2022. The group is known for targeting mid-sized organizations, including healthcare providers, manufacturers, and nonprofits. Its typical playbook begins with phishing or exploited remote desktop credentials, followed by deployment of custom ransomware, exfiltration of sensitive files, and dual extortion: demanding payment to decrypt systems and a second sum to prevent data publication. Prior victims listed on its leak site include municipal governments and educational institutions, many of which saw partial data samples released before full dumps appeared when negotiations failed.

What to do

• Run a DoxxScan to map every link between your church-related emails, phone numbers, addresses, and real-world identity, then use the cleanup of Warden to break those chains.
• Enable continuous DoxxScan monitoring so the next time your information surfaces from a ransomware leak or downstream sale it is caught and acted on within hours.
• Rotate any password you ever used for Pennsylvania Southeast Conference systems, church email, or donation portals anywhere it has been reused, and switch to 2FA through an authenticator app rather than SMS.
• Cover the household—DoxxScan family coverage extends to dependents, spouses, and children’s gaming accounts that often chain back to the same leaked family address or parent email.
• Let remediation specialists handle takedown requests for any exposed documents or personal listings that appear on data-broker and extortion sites.

The incident underscores that even regional religious organizations now sit in the crosshairs of profit-driven ransomware operators who treat member and donor data as currency. Acting quickly on the exposure can limit how far the stolen information travels. Start your DoxxScan trial today to gain both immediate visibility into what has already leaked and ongoing protection for every member of your household.