omf.org Listed by lockbit5 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
omf.org has been listed by the lockbit5 ransomware group, with internal files reported exfiltrated; the incident came to light on December 24, 2025, but the actual date of the breach is not established. Individuals who may have shared data with omf.org are advised to monitor their accounts and follow any guidance the organisation issues.
What happened
Public records show that lockbit5 added omf.org to its leak site on December 24, 2025. The group states that internal files were exfiltrated during a ransomware attack. No confirmed count of affected individuals or specific timeline of the intrusion has been released. The organization has not issued a public statement detailing the event.
Inside lockbit5
Lockbit5 operates as a ransomware-as-a-service group that typically deploys encryption on victim systems while copying data for later leverage. The group maintains a leak site where it lists organizations and posts samples of claimed stolen material when ransom demands are not met. Prior public reporting has documented similar activity against entities in multiple sectors, with the group using established tools for initial access and lateral movement. In this case the listing of omf.org constitutes an unverified claim by the group.
About omf.org
OMF describes itself as a global fellowship of Christians focused on East Asia. Organizations of this type commonly maintain records related to staff, volunteers, donors, and program participants across multiple countries. A breach at such an entity can expose information that spans personal identifiers, financial details, and operational correspondence.
What data was at risk
The only detail released states that internal files were exfiltrated. The precise categories of data contained in those files have not been disclosed. Organizations in the non-profit and religious sectors routinely hold contact information, donation records, personnel files, and correspondence; however, whether any of these categories were present in the exfiltrated material remains unconfirmed.
Why it matters
Individuals connected to OMF may face risks of targeted phishing, identity misuse, or unwanted contact if personal details were included in the files. For the organization, the incident adds operational strain and potential loss of trust among supporters who expect their information to remain protected. The absence of Reported Details on scale or content leaves both the organization and affected people without a clear basis for immediate response.
If your data was in this claimed breach
Monitor accounts linked to any email or contact details you have shared with OMF for unusual activity. Enable multi-factor authentication on those accounts and review recent statements for unauthorized transactions. You can also run a free exposure scan of your email address against known breach datasets to check for prior appearances of your information.
- Change passwords for any accounts associated with OMF.
- Watch for unsolicited messages that reference the organization.
- Contact OMF directly for any official guidance it may issue.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
jvdbassoc.com Listed by lockbit5 Ransomware Groupnpiav.com Listed by lockbit5 Ransomware Groupkll-law.com Listed by lockbit5 Ransomware Grouprjrgleanergroup.com Listed by lockbit5 Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the omf.org Listed by lockbit5 Ransomware Group →
Publicly posted by lockbit5 — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.