PSEC Church Listed by incransom Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On March 29, 2024, the ransomware group known as incransom listed PSEC Church among the organisations it claims to have attacked. According to the available record, the incident involved the exfiltration of internal files. The number of people affected has not been disclosed, and further public detail about the scale, timing, or method of the intrusion remains limited.

For a regional church conference that serves congregations and individuals across a populated area, any confirmed compromise of internal records carries practical consequences for members, staff, and the organisation itself. What follows summarises only what has been reported and places it in context without speculation.

What happened

Public reporting states that PSEC Church was listed by the incransom ransomware group on March 29, 2024. The listing indicates that internal files were exfiltrated during a ransomware attack. No confirmed figures for the volume of data taken, the precise date of the intrusion, or the technical method used have been released. The number of individuals whose information may have been involved is recorded as unknown. Because the primary source of the claim is the group’s own leak-site listing, the assertion that PSEC Church was successfully compromised should be treated as an unverified claim pending independent confirmation by the organisation or law-enforcement authorities.

Who is incransom?

Incransom is a ransomware operation that has appeared in public threat-intelligence reporting as a group that encrypts victim systems and simultaneously steals data for leverage. Like many contemporary ransomware actors, it typically posts victim names on a dedicated leak site and threatens to publish or auction the stolen material if a ransom is not paid. The group’s public activity has included listings of organisations across multiple sectors; its tactics generally follow the double-extortion model common among ransomware crews since the early 2020s. No statements attributed specifically to incransom about the contents of any files allegedly taken from PSEC Church appear in the available record beyond the general claim of internal-file exfiltration.

About PSEC Church

PSEC Church refers to the Pennsylvania Southeast Conference of the United Church of Christ. The United Church of Christ is organised into 38 regional conferences, each with its own administrative identity. The Pennsylvania Southeast Conference covers a diverse geographic area that includes Philadelphia and its surrounding suburbs. As a regional ecclesiastical body, it coordinates pastoral support, congregational resources, and administrative functions for member churches. Organisations of this type routinely maintain records related to clergy, lay leaders, congregational membership, financial contributions, and internal correspondence. A breach affecting such an entity is consequential because the data it holds often includes personally identifiable information of people who expect a high degree of confidentiality from their faith community.

What was likely exposed

The only data category named in the public record is “internal files” said to have been exfiltrated in a ransomware attack. No further breakdown of file types, databases, or specific categories of personal information has been disclosed. Exact contents therefore remain unconfirmed. Organisations comparable to a regional church conference typically hold membership directories, contact details, donation or payroll records, personnel files, and internal communications. Whether any of those categories were among the files allegedly taken from PSEC Church cannot be verified from the information currently available.

What's at stake

If personal data belonging to members, staff, or clergy were among the exfiltrated files, affected individuals face the ordinary risks associated with any unauthorised disclosure: potential misuse of contact information, targeted phishing that references church affiliation, or identity-related fraud. For the organisation itself, the incident raises operational and reputational considerations, including the need to notify affected parties if required by law, to assess residual access by the attackers, and to restore confidence among congregations that rely on the conference for administrative and pastoral services. Because the number of people affected is unknown and the precise data set is undisclosed, the full scope of these risks cannot yet be quantified.

What to do if you're exposed

Anyone who has been associated with PSEC Church or its member congregations and is concerned that their information may have been involved should begin with basic protective steps: monitor financial and email accounts for unusual activity, enable multi-factor authentication where available, and treat unsolicited messages that reference church membership with caution. If official notification is received from the organisation, follow the guidance it provides. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets, which can help determine whether further monitoring or credential changes are warranted.

AICompiled with AI assistance from public sources and published under our editorial standards.