Two Saints Listed by noescape Ransomware Group

On October 25, 2023, Two Saints appeared on the leak site operated by the noescape ransomware group. The UK-based charity, which provides outreach to people sleeping rough and supported accommodation across Berkshire, Hampshire, the Isle of Wight, Portsmouth and Southampton, had its internal files exfiltrated during a ransomware attack. The listing does not specify the number of people affected or detail the exact records involved.

Details in the Leak-Site Posting

The noescape leak site states that Two Saints suffered a ransomware incident and that attackers successfully exfiltrated internal files before encryption. No sample data is publicly shown, and the posting does not quantify how many records were taken or name the specific systems accessed. The disclosure indicates the organisation was given a deadline to negotiate or face full publication of the stolen material. As of the listing date, the files had not yet been released to the public.

Internal files exfiltrated is the only description provided. The notification does not list exposed data types such as donor records, client personal information, staff payroll or contracts, leaving the precise scope unknown to outsiders.

Why This Matters for You and Your Family

When a charity like Two Saints is breached, the people it serves are often among the most vulnerable. Rough-sleepers, families in temporary accommodation and those receiving outreach support frequently share sensitive personal details to receive help. If those details reach criminals, the consequences reach far beyond the organisation itself. You or someone in your household could be affected even if you have never heard of Two Saints, because support-service records sometimes contain addresses, phone numbers, next-of-kin contacts and benefit information that travel with you long after the interaction ends.

A breach of this kind also erodes trust in the very organisations that hold the most intimate data about struggling families. The fact that the victim count remains unknown makes it harder for individuals to know whether their information is among the stolen material.

Doxxing and Identity-Chain Risks

Exfiltrated internal files from a homelessness charity frequently contain information that links real identities to temporary addresses, phone numbers, email accounts and support-worker notes. Attackers can combine these fragments with data from previous breaches to build persistent identity chains. A single leaked support record can tie an individual’s current location to an old username, a child’s school record or a gaming handle, turning one breach into a lifelong doxxing vector.

Credential leaks that surface in these incidents often cascade into account takeovers. Gaming accounts belonging to you or your children are especially exposed because the same email or password reused for a support-service portal may also protect Steam, Roblox, Epic or Discord logins. Once those gaming profiles are hijacked, attackers can harvest additional personal photos, chat logs and friend connections that further enrich the identity dossier.

The Noescape Ransomware Group’s Track Record

Public reporting attributes the first known activity by noescape to mid-2023. The group emerged as a ransomware-as-a-service operation that combines double-extortion tactics with aggressive data-leak tactics. Notable prior victims include healthcare providers, local government bodies and mid-sized service organisations. Their typical playbook begins with initial access gained through compromised remote desktop credentials or phishing, followed by rapid lateral movement, data exfiltration and then encryption. The extortion phase usually involves publishing a small sample on their leak site and giving the victim a short window to pay before releasing the full archive. The group’s leak site remains active on the dark web and continues to list new victims on a regular basis.

What to do

• Rotate any password you ever used with Two Saints or similar support services and enable 2FA through an authenticator app on every account where that password was reused.
• Run a DoxxScan to map every link between your emails, phone numbers, usernames and real-world identity, then use the cleanup of Warden to remove what you can.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your data appears it is caught within hours rather than months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same address or parent email.
• Let remediation specialists handle repeated takedown requests across data brokers and leak sites on your behalf.

The Two Saints breach is a reminder that data belonging to vulnerable individuals can quickly become ammunition for identity thieves and extortionists. Acting quickly on credential hygiene and identity mapping gives you the best chance of breaking the chain before criminals exploit it. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with household coverage that includes children’s gaming accounts at risk from cascading credential leaks like this one.