The Salvation Army Listed by interlock Ransomware Group

On May 24, 2025, the Salvation Army appeared on the leak site of the interlock ransomware group after internal files were exfiltrated during a ransomware attack. The organization, founded in 1865, provides food assistance, disaster relief, shelter, clothing, and support programs for children, the elderly, the disabled, and the homeless. While the exact number of individuals whose information may have been exposed remains unknown, anyone who has interacted with the Salvation Army—through donations, volunteering, job applications, or receiving services—may have records included in the stolen data.

What Public Reporting Shows

Available reporting describes the incident as a ransomware attack in which interlock gained access to the Salvation Army’s systems, exfiltrated files, and later listed the organization on its public leak site. The data exposed consists of internal files; specific categories mentioned in public posts include documents that could contain donor records, employee information, client case files, and operational details. No confirmed count of affected records has been released. The Salvation Army has not yet issued a detailed public statement on the volume or sensitivity of the stolen information.

Why This Matters for You and Your Family

When a large charity like the Salvation Army suffers a breach, ordinary people are often the ones at risk. You or your family may have provided personal details when seeking emergency help, applying for assistance programs, donating goods, or signing children up for youth activities. Internal files frequently hold names, addresses, phone numbers, dates of birth, Social Security numbers, banking information for recurring donors, and email addresses. Once this information leaves secure systems, it can be sold, traded, or used to target you with identity theft, phishing, or financial fraud. Children’s records held by charitable organizations are especially concerning because they can be paired with gaming usernames or school details later.

The Doxxing and Identity-Chain Implications

Ransomware leaks rarely stop at one organization. A single exposed email or phone number can be cross-referenced with data from previous breaches, creating an identity chain that links your online handles, family members’ accounts, and real-world identity. Public reporting indicates that attackers and data brokers routinely combine leaked charity records with information from retail breaches, streaming services, and gaming platforms. This chaining process turns a single incident into long-term exposure. Credential leaks like this one often cascade into account takeovers on gaming platforms, where children’s usernames and passwords are reused, opening the door to harassment, doxxing, and further extortion.

Interlock Ransomware Group’s Track Record

Public reporting attributes interlock with emerging in late 2023 and focusing on both mid-sized businesses and larger nonprofit organizations. Notable prior victims listed on its leak sites have included healthcare providers, local governments, and other charitable entities. The group’s typical playbook involves initial access through phishing or exploited remote desktop credentials, followed by exfiltration of sensitive files before deploying ransomware. They then demand payment for decryption and to prevent publication of the stolen data. If no payment is received, interlock publishes samples and eventually releases larger batches of internal documents on its onion site.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real identity so you can see exactly what chains back to the Salvation Army records.
• Rotate any password you ever used with the Salvation Army anywhere it has been reused, and switch to 2FA through an authenticator app rather than text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information surfaces you learn within hours instead of months.
• Cover the household with DoxxScan family protection that includes dependents and your children’s gaming accounts, which often become targets when credential leaks create doxxing chains.
• Let remediation specialists handle takedown requests for any exposed personal documents or broker listings that appear after this incident.

The incident shows how quickly data from trusted nonprofit organizations can reach criminals who specialize in chaining identities across breaches. Taking concrete steps now limits how far this exposure can spread. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Source: interlock leak site (via ransomware.live)