GROWTH by NCRC Listed by bianlian Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On January 18, 2024, GROWTH by NCRC appeared on a listing published by the ransomware group known as bianlian. Public reporting indicates that the group claims to have carried out a ransomware attack involving the exfiltration of internal files. The number of people affected remains unknown, and further specifics about the incident have not been disclosed.

The listing matters because GROWTH by NCRC operates in community development and housing rehabilitation, areas that routinely involve sensitive organizational and personal information. Until more details emerge, the claim itself is the primary public signal that data may have been taken.

What happened

According to available reports dated January 18, 2024, GROWTH by NCRC was listed by the bianlian ransomware group. The group claims that internal files were exfiltrated as part of a ransomware attack. No confirmed figures have been released for the volume of data taken, the precise date of intrusion, the method of access, or the number of individuals whose information may be involved. Public detail on whether systems were encrypted, whether a ransom demand was made, or whether any recovery steps have been completed is limited. The listing itself constitutes an unverified claim by the group rather than an independently confirmed disclosure by the organization.

Who is bianlian?

Bianlian is a ransomware group that has operated publicly since at least 2022. Like many contemporary ransomware operators, it typically employs a double-extortion model: encrypting systems while also copying data and threatening to publish or sell it if payment is not made. The group maintains a leak site where it posts victim names and, in some cases, samples of stolen files to increase pressure. Its targets have historically included organizations across multiple sectors rather than a single industry focus. Public reporting has associated bianlian with attacks that emphasize data theft alongside encryption. In this instance, the group’s listing of GROWTH by NCRC should be treated as its own claim; independent verification of the full scope of any compromise has not been provided in the available facts.

About GROWTH by NCRC

GROWTH by NCRC is the name associated with the NCRC Housing Rehab Fund. It forms part of the broader National Community Reinvestment Coalition (NCRC) network. NCRC invests in and manages affiliated social enterprises and investment funds aimed at expanding access to affordable home ownership, living-wage jobs and careers, and capital for small businesses. The NCRC Community Development Fund is a U.S. Department of the Treasury-certified Community Development Financial Institution that makes loans intended to support economic mobility, address racial wealth gaps, expand affordable homeownership, and provide capital to Black-, Brown-, and woman-owned businesses. GROWTH by NCRC specifically focuses on housing rehabilitation work within this ecosystem. Organizations of this type typically handle project records, financial documentation, partner and borrower information, and operational files related to community development activities. A claimed breach therefore carries potential consequences for both the institution’s operations and the communities it serves.

What data was at risk

The available facts state that internal files were exfiltrated in a ransomware attack. No further breakdown of file categories, record counts, or specific data elements has been disclosed. Because the precise contents remain unconfirmed, it is not possible to state with certainty what personal or organizational information was taken. Organizations engaged in community development finance and housing rehabilitation commonly maintain internal documents that may include loan and project files, contractor or partner records, financial statements, employee information, and correspondence. Whether any of those categories were among the files claimed by bianlian has not been publicly verified. Readers should treat the exposure as limited to the general description of “internal files” until additional Reported Details appear.

Why it matters

For individuals connected to GROWTH by NCRC—whether as borrowers, partners, employees, or community members—the primary concern is the potential misuse of any personal or financial details that may have been among the internal files. Even without confirmed identity-theft cases, the presence of organizational records on a ransomware leak site can create lasting risk of phishing, social engineering, or secondary fraud. For the organization itself, a claimed data theft can disrupt operations, strain relationships with funders and community partners, and require resource-intensive investigation and remediation. Because the number of people affected is unknown and the exact data types remain undisclosed, the full scale of impact cannot yet be measured. The incident underscores the broader exposure faced by community-development entities that hold sensitive operational and personal information while serving populations that may have limited resources to recover from identity-related harm.

What to do if you're exposed

If you have a past or present relationship with GROWTH by NCRC or related NCRC programs, treat the listing as a prompt for caution rather than confirmed personal compromise. Monitor financial accounts and credit reports for unexpected activity. Be alert to unsolicited contacts that reference housing, loans, or community programs and verify any such outreach through official channels. Consider placing a fraud alert or credit freeze with the major credit bureaus if you believe sensitive personal data could be involved. Keep records of any suspicious communications. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets, which can help determine whether further monitoring is warranted.

AICompiled with AI assistance from public sources and published under our editorial standards.