Canvas Church Listed by qilin Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Canvas Church was listed on a ransomware group's data-leak site on December 6, 2025. The entry states that internal files were removed during a ransomware operation, though the number of individuals whose information may be involved has not been disclosed. The practical implication is that any personal or administrative records held by the church could now circulate beyond the organization's control. Without Reported Details on the volume or content of the files, affected people have limited visibility into their specific exposure.

Inside the incident

The only confirmed information is the December 6, 2025 listing on the Qilin ransomware group's site. The group claims to have stolen internal data from Canvas Church. No public statement from the church has detailed the date of the intrusion, the method of access, or the scale of the operation. The number of people affected is reported as unknown.

Who is qilin?

Qilin is a ransomware-as-a-service operation that has been publicly tracked since 2022. The group typically gains access through compromised credentials or unpatched systems, deploys encryption, and then posts samples of stolen files on a dedicated leak site when a ransom demand is not met. Its listings have included healthcare providers, manufacturers, and educational institutions in multiple countries. The appearance of an organization on the site constitutes the group's claim of possession; independent verification of the data's authenticity or completeness is not available from public sources.

Who is Canvas Church?

Canvas Church is a religious organization that maintains records on members, attendees, volunteers, and donors. Such organizations routinely collect names, addresses, contact details, giving histories, and occasionally background or pastoral-care notes. A breach at an entity of this type is consequential because the data often includes long-term personal relationships and financial information that is not frequently updated or monitored for misuse.

The information in question

The listing refers to “internal files” without specifying their contents. The exact categories of data therefore remain unconfirmed. Organizations of this kind commonly store membership directories, financial contribution records, event participant lists, and limited employee or volunteer files. Any assessment of risk must treat these possibilities as unverified until the church or investigators release further detail.

What's at stake

Individuals whose records appear in the exfiltrated files could face targeted phishing, account takeovers, or unwanted contact if contact information or giving patterns are exposed. The church itself may encounter operational disruption, legal notification requirements, and loss of trust among its community. Because the number of records and their sensitivity are unknown, the scope of these outcomes cannot be quantified from currently available information.

If your data was in this claimed breach

Monitor bank and credit accounts for unusual activity and place fraud alerts with major credit bureaus if statements or financial records were among the files. Update passwords for any accounts linked to the church and enable multi-factor authentication where available. Readers can run a free exposure scan of their email address against known breach data to determine whether their information has appeared in previously published datasets.

AICompiled with AI assistance from public sources and published under our editorial standards.