Catholic Charities Listed by incransom Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target nonprofits and social-service providers, treating the sensitive records these organizations hold as leverage. In that landscape, the appearance of Catholic Charities on a ransomware leak site is a reminder that even mission-driven agencies face the same extortion tactics used against larger enterprises.

On October 13, 2023, the group known as incransom listed Catholic Charities, claiming it had exfiltrated internal files in a ransomware attack. The number of people affected remains unknown, and public detail beyond the listing itself is limited. For anyone who has received services or worked with the organization, the claim raises practical questions about what may have been taken and what steps are worth taking now.

Inside the incident

Public reporting states that Catholic Charities was listed by the incransom ransomware group on October 13, 2023. The group claims internal files were exfiltrated in a ransomware attack. No confirmed figure for the number of people affected has been released, and the precise method of intrusion, the duration of any unauthorized access, and the full scope of systems involved have not been disclosed in the available record.

The reported summary notes that Catholic Charities of Broome County serves as the lead agency in a joint initiative called Encompass Family Health Home, selected in June 2015 by the New York State Department of Health. Beyond that organizational context and the leak-site claim, further technical or forensic detail about this specific incident has not been made public. The listing itself should be treated as an unverified claim by the threat actor unless independently confirmed.

Inside incransom

Incransom is a ransomware operation that follows a familiar double-extortion model: encrypting systems while also copying data, then threatening to publish the stolen material if payment is not made. Like other groups in this category, it maintains a leak site where it names victims and, in some cases, posts samples or larger archives to increase pressure. Public reporting on the group has described typical tactics that include initial access through compromised credentials or exposed services, followed by lateral movement, data staging, and deployment of ransomware.

Notable prior activity attributed to incransom has involved organizations across multiple sectors; the group’s public postings are claims intended to force negotiation and should not be read as independently verified inventories of what was taken. In this case, the only specific assertion tied to Catholic Charities is the listing and the statement that internal files were exfiltrated. No further claims by the group about this victim are detailed in the available facts.

About Catholic Charities

Catholic Charities is a network of charitable organizations that provide social services, including assistance with housing, food, family support, health-related programs, and other community aid. Agencies under this umbrella often work with people in vulnerable circumstances and partner with government and local initiatives. Catholic Charities of Broome County, referenced in connection with the Encompass Family Health Home program, illustrates the kind of multi-agency health and social-service work these organizations undertake.

A breach affecting such an agency is consequential because the data it holds can include personal identifiers, case notes, health-related information, financial assistance records, and contact details for clients, staff, and partners. Even when the exact contents of a claimed exfiltration remain unconfirmed, the sector’s reliance on trust and confidentiality means any credible claim of data theft can affect both the people served and the organization’s ability to operate without disruption or reputational harm.

The information in question

The facts name the exposed material only as internal files exfiltrated in a ransomware attack. No itemized list of data types—such as names, addresses, Social Security numbers, medical details, or financial records—has been publicly confirmed. The number of individuals potentially affected is unknown.

Organizations of this kind typically maintain records needed to deliver services: client intake forms, eligibility documentation, case-management notes, employee and volunteer information, and correspondence with partner agencies. Whether any of those categories were among the files the group claims to have taken is unconfirmed. Until more detail is released by the organization or verified through independent reporting, the precise contents of the alleged exfiltration remain undisclosed.

The real-world impact

For people who have interacted with Catholic Charities, the primary risks associated with a ransomware-related data theft are misuse of personal information, targeted phishing or social-engineering attempts that reference real case details, and, in some scenarios, identity theft or fraud. Because the scale and exact data types are unknown, it is not possible to state how widely those risks apply; the absence of confirmed numbers does not eliminate the need for caution among those who may be in the organization’s records.

For the organization, a claimed ransomware incident can mean operational disruption, costs related to investigation and recovery, notification obligations where applicable, and strain on relationships with clients and partners who expect confidentiality. The impact is concrete even when public detail is sparse: trust is harder to maintain when a threat actor asserts that internal files have left the network, and recovery requires both technical work and clear communication.

What to do if you're exposed

If you believe you may have been connected to Catholic Charities as a client, employee, volunteer, or partner, practical first steps reduce the chance that stolen information—if any—is used against you. Public confirmation of individual exposure has not been provided, so these measures are precautionary rather than proof that your data was involved.

• Monitor account statements and credit reports for unfamiliar activity and consider a fraud alert if you have reason for heightened concern.
• Treat unexpected emails, calls, or messages that reference Catholic Charities or social-service case details with skepticism; verify through official channels before sharing information or clicking links.
• Change passwords on important accounts, especially if you reused credentials in any context related to the organization, and enable multi-factor authentication where available.
• Keep records of any official notices you receive from the organization and follow instructions in those notices for credit monitoring or other support if offered.
• Run a free exposure scan of your email address to check whether it has already appeared in known breach data sets, which can help you prioritize further monitoring.

Remain attentive to official updates from Catholic Charities. Until more is confirmed, calm vigilance—rather than assumption of the worst—is the most useful response.

AICompiled with AI assistance from public sources and published under our editorial standards.