uwock.ca Listed by safepay Ransomware Group

On August 29, 2025, the ransomware group Safepay added uwock.ca to its leak site, claiming that it had exfiltrated internal files from Information Chatham-Kent, a nonprofit service operated under United Way Chatham-Kent in Ontario, Canada.

What's Publicly Reported from Reporting

Public reporting indicates the organization provides community services across the Chatham-Kent region. The incident follows the typical ransomware pattern of initial access, data exfiltration, and subsequent extortion pressure. Available details show that internal files were taken, though the exact volume and full list of records remain undisclosed on the leak site. No specific victim count has been published, leaving thousands of local residents, donors, volunteers, and program participants uncertain about whether their information is among the stolen data. The posting appeared on the group's onion site, which serves as its primary channel for naming victims and publishing samples or demands.

Why This Matters for You and Your Family

When a local nonprofit like United Way Chatham-Kent suffers a breach, the impact reaches ordinary families who interacted with its programs, donated online, or supplied contact details for volunteer work or assistance services. Internal files often contain names, addresses, phone numbers, email accounts, and financial information tied to donations or service records. If your family has lived in or near Chatham-Kent, used any United Way-affiliated service, or appeared in partner agency records, your personal data may now sit on a criminal leak site. Once exposed, this information rarely disappears quietly; it circulates among data brokers, fraudsters, and doxxers who combine it with other leaks to build detailed profiles.

The Doxxing and Identity-Chain Implications

A single breach rarely stops at one dataset. Credential leaks and contact details from nonprofits frequently cascade into account takeovers elsewhere, especially when the same email and password were reused across services. Gaming accounts belonging to you or your children are particularly vulnerable because they often link back to household email addresses or phone numbers. Public reporting on similar incidents shows that attackers chain these exposures: an email from the nonprofit leak leads to a recovered password on a gaming platform, which then reveals real names, locations, and photos. The result is doxxing that can expose your family's home address, children's usernames, and daily routines. Identity-chain mapping becomes essential because one leak can unlock multiple seemingly unrelated accounts.

Safepay Group's Publicly Known Track Record

Public reporting attributes Safepay with emerging in late 2024 as a ransomware operation that combines double-extortion tactics with leak-site pressure. The group has listed healthcare providers, local governments, and nonprofits among its prior victims, typically gaining initial access through phishing or exploited remote desktop protocols. After exfiltrating data, Safepay follows a standard playbook: it gives the victim a short window to negotiate before publishing samples and eventually releasing larger portions of the stolen files. Its leak site serves both as a shaming mechanism and a marketplace for other criminals to browse the data. Exact success rates remain unclear, but the group's consistent posting schedule suggests it maintains steady pressure on organizations that refuse payment.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by the service.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure is caught in hours rather than months.
• Rotate any password you used on uwock.ca or related United Way services wherever it appears, and switch to 2FA through an authenticator app instead of text messages.
• Cover the household with DoxxScan family protection that extends to dependents and children's gaming accounts which often chain back to the same contact details.
• Let remediation specialists manage takedown requests across data brokers and leak sites on your behalf while you focus on securing daily accounts.

The incident underscores that even community organizations holding ordinary family data remain targets, and waiting for confirmation that your records were taken is no longer a viable strategy. Start your DoxxScan trial today to gain continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping that links handles to real identities, hands-on remediation by specialists, and full household coverage including children's gaming accounts. Taking these steps now limits how far attackers can travel down the chain that begins with this claimed breach.