Dignity Phoenix Listed by CRPxO Ransomware Group: What Was Exposed & What To Do

Dignity Phoenix, a non-profit organisation in the social services sector, was listed by the CRPxO ransomware group on or around July 27, 2026. Public reporting states that internal files were exfiltrated in a ransomware attack and that approximately 5.4 GB of data was claimed as leaked. The number of people affected remains unknown, and many operational details of the incident have not been disclosed.

For individuals who have interacted with Dignity Phoenix as clients, donors, staff, or partners, a listing of this kind raises practical questions about what information may have left the organisation’s control and what steps are worth taking while fuller confirmation is still limited.

Breaking down the breach

According to available reporting, Dignity Phoenix appeared on a CRPxO leak-site listing associated with a ransomware attack in which internal files were said to have been exfiltrated. The reported volume of data linked to the claim is 5.4 GB. The listing was reported on July 27, 2026. Beyond that core claim, public detail is limited.

It has not been publicly confirmed how the attackers gained access, how long they may have been inside the environment, or whether encryption of systems occurred alongside the claimed exfiltration. The number of individuals whose information may be involved is unknown. No independent verification of the full contents of the 5.4 GB set has been detailed in the facts available here. The group’s leak-site listing should be treated as a claim by the threat actor rather than as independently established fact unless further confirmation emerges.

Who is CRPxO?

CRPxO is known publicly as a ransomware group that engages in attacks typically involving unauthorised access to an organisation’s systems, theft of data, and pressure to pay through the threat of publication. Like many groups operating in this space, CRPxO has been associated with double-extortion style activity: encrypting or disrupting systems while also claiming to hold stolen files and listing victims on a dedicated leak site if demands are not met.

Public reporting on such groups generally describes tactics that can include phishing, exploitation of exposed remote access services, or abuse of stolen credentials, followed by lateral movement and data staging before any ransom demand. Specific claims CRPxO has made about Dignity Phoenix beyond the listing itself and the reported 5.4 GB of internal files are not detailed in the available facts; only the group’s claim that the organisation was hit and that data was taken should be attributed to them here.

Who is Dignity Phoenix?

Dignity Phoenix operates in the non-profit and social services sector. Organisations of this type commonly deliver support programmes, case management, community assistance, or related services, and they routinely handle sensitive personal and administrative information in order to serve clients and manage operations.

A breach affecting a social-services non-profit is consequential because the data such organisations hold often relates to people in vulnerable circumstances, as well as to staff, volunteers, and donors. Even when the precise contents of a claimed leak remain unconfirmed, the sector context means that exposure can touch identities, contact details, service records, and internal operational material that was never intended for public release. The organisation itself faces operational, reputational, and compliance pressures common to non-profits that experience ransomware claims.

The information in question

The facts name the exposed material as internal files exfiltrated in a ransomware attack, with a reported data volume of 5.4 GB. Exact file inventories, named data categories beyond “internal files,” and confirmation of which systems were involved have not been disclosed in the available record.

Organisations in non-profit social services typically hold records that can include client names and contact information, case or service notes, intake forms, donor and fundraising lists, employee and volunteer records, financial and administrative documents, and internal correspondence. That is the general profile of data such entities manage; it is not a confirmation that every one of those categories was present in the 5.4 GB set claimed by CRPxO. Until more specific disclosure occurs, the precise contents remain unconfirmed, and the threat actor’s description should be read as a claim.

The real-world impact

For people connected to Dignity Phoenix, the main risks are practical rather than abstract. If personal or case-related information was among the internal files, affected individuals could face phishing or social-engineering attempts that reference real details, unwanted contact, or misuse of identity information over time. Even partial internal documents can help criminals craft more convincing messages. Because the count of people affected is unknown, it is not possible to state how widely those risks extend.

For the organisation, a ransomware-related listing can mean disruption to services, cost and effort around investigation and recovery, notification obligations where applicable, and strain on trust with clients and partners. Non-profits often operate with limited security resources, so recovery and communication can take longer than in larger enterprises. None of this establishes negligence as fact; it describes the ordinary consequences that follow when a group claims to have stolen internal data and posts a victim listing.

Until the organisation or independent reporting clarifies what was actually taken and who was notified, individuals should treat the situation as a credible warning rather than as a fully mapped incident.

Were you affected?

If you have been a client, donor, employee, volunteer, or partner of Dignity Phoenix, monitor accounts and inboxes for unusual messages that reference the organisation or personal details you shared with it. Prefer official channels if the organisation publishes guidance or breach notices. Consider placing fraud alerts with credit services where appropriate, and be cautious about sharing further personal data in response to unsolicited contact. Change passwords on related accounts if you reused credentials, and enable multi-factor authentication where available.

You can also run a free exposure scan of your email address to check whether your information has already surfaced in known breach datasets. That check will not prove or disprove involvement in this specific incident, but it can help you see whether your address appears in other circulated collections and prioritise further precautions.

AICompiled with AI assistance from public sources and published under our editorial standards.