Bethany Lutheran Church Listed by qilin Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Bethany Lutheran Church, a congregation based just south of Grantsburg, Wisconsin, was listed by the qilin ransomware group on February 14, 2025. Public reporting indicates that internal files were exfiltrated in a ransomware attack, though the number of people affected remains unknown and further details about the incident are limited.

The listing itself is a claim by the group rather than independent confirmation of every asserted detail. For a local church that serves its community through worship and educational programming, any unauthorized access to internal records raises practical concerns about the privacy of members, staff, and others connected to the organization.

Breaking down the breach

According to available information, Bethany Lutheran Church appeared on a qilin leak site on February 14, 2025. The reported summary describes the organization as a dynamic church located just south of Grantsburg, Wisconsin, that invites the public to Sunday School and educational programming for all ages followed by worship. The only data-related detail provided is that internal files were allegedly exfiltrated in a ransomware attack. No figure has been given for the number of people affected, and public detail does not disclose the precise date of the intrusion, the method of initial access, the volume of data taken, or whether encryption of systems also occurred. The listing is therefore treated as an unverified claim by the group pending any further official statements.

The group behind it: qilin

qilin is a well-documented ransomware operation that has operated as a ransomware-as-a-service model. Public reporting over recent years has associated the group with double-extortion tactics: encrypting victim systems while also stealing data and threatening to publish it if a ransom is not paid. The group has previously listed organizations across multiple sectors on its leak sites, using those listings both as pressure and as a means of advertising successful compromises. In this case, the appearance of Bethany Lutheran Church on the site constitutes the group’s claim that it obtained and is prepared to release internal files; no independent verification of the full scope of that claim has been included in the available facts.

Bethany Lutheran Church and its sector

Bethany Lutheran Church is a local Christian congregation serving the area south of Grantsburg, Wisconsin. Like many churches of its size, it conducts regular worship services, Sunday School, and educational programs open to people of various ages. Religious organizations typically maintain records related to membership, attendance, donations, volunteer coordination, staff employment, and pastoral care. These records can include names, contact details, contribution histories, and sometimes more sensitive personal notes. A breach affecting such an institution is consequential because the data often concerns individuals who have placed trust in a community institution rather than a commercial enterprise; the potential exposure of that information can affect both privacy and the sense of security within the congregation.

What was likely exposed

The facts state only that internal files were exfiltrated. No specific categories of personal data—such as names, addresses, financial records, or medical information—have been publicly confirmed. Organizations of this type commonly hold membership directories, donation and pledge records, staff and volunteer contact lists, and administrative documents. Because the exact contents remain undisclosed, it is not possible to state with certainty which of these, if any, were among the files taken. Readers should treat any more detailed claims about the data as unconfirmed until additional information is released by the church or by independent investigators.

The real-world impact

For individuals whose information may have been among the internal files, the primary risks are identity-related misuse, unwanted contact, or social-engineering attempts that reference church affiliation. Even limited personal details can be combined with other publicly available information to craft more convincing phishing messages. For the church itself, the incident can disrupt administrative operations, require notification and support efforts for members, and create lasting questions about the security of future records. Because the number of people affected is unknown, the full scale of these effects cannot yet be measured. The listing by a ransomware group also carries the possibility that data could be published or sold if negotiations do not resolve the matter, though that outcome is not guaranteed by the mere fact of the listing.

What to do if you're exposed

Anyone who has been associated with Bethany Lutheran Church—members, donors, staff, or volunteers—should monitor financial accounts and credit reports for unusual activity and remain alert to unexpected emails or calls that reference the church. Changing passwords on any accounts that may have shared credentials with church systems is a prudent step. Free tools that scan an email address against known breach data can help determine whether personal information has already appeared in public dumps. If you receive a notification from the church itself, follow the guidance it provides. Document any suspicious contacts and consider placing a fraud alert with the major credit bureaus if you believe sensitive identifiers may have been involved. Public detail remains limited, so continued attention to official updates from the organization is advisable.

AICompiled with AI assistance from public sources and published under our editorial standards.