Saint Mark Catholic Church Listed by bianlian Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to pressure organisations of every size by stealing internal data and threatening to publish it, a pattern that has reached schools, clinics, charities and places of worship alike. In that landscape, a listing that appeared in late September 2023 drew attention to a religious institution few outside its community would have expected to see named.

On 26 September 2023, the ransomware group known as bianlian publicly listed Saint Mark Catholic Church, claiming it had exfiltrated internal files in a ransomware attack. The number of people affected remains unknown, and independent confirmation of the full scope has not been published. For parishioners, staff and anyone who has shared information with the church, the listing raises practical questions about what may have been exposed and what steps are worth taking.

Inside the incident

Public reporting on the incident is limited to the fact that Saint Mark Catholic Church appeared on bianlian’s leak site on or about 26 September 2023. The group claimed that internal files had been exfiltrated as part of a ransomware attack. No detailed timeline of intrusion, no confirmed ransom demand, no statement of whether systems were encrypted, and no verified count of affected individuals have been released in the available record. The precise method of initial access is likewise undisclosed. What is known is the claim itself: that data left the organisation’s control and that the group chose to name the church publicly.

Because the listing is an assertion by the threat actor rather than a confirmed disclosure by the victim or a regulator, the full accuracy and completeness of the claim cannot be independently verified from the facts at hand. Organisations in similar situations sometimes negotiate, sometimes restore from backups, and sometimes remain silent; none of those outcomes is documented here.

Who is bianlian?

Bianlian is a ransomware operation that has been active for several years and is known for double-extortion tactics. After gaining access to a network, the group typically steals data before or instead of deploying encryption, then threatens to publish the material on a dedicated leak site if payment is not made. Bianlian has targeted a range of sectors, including professional services, manufacturing, healthcare and smaller institutions that may have fewer dedicated security resources. The group’s public posts often include sample files or directory listings intended to prove possession of the data and to increase pressure on the victim.

Like other ransomware crews, bianlian relies on common initial-access routes such as compromised credentials, phishing, or unpatched remote-access services, though the specific vector used against any single victim is rarely confirmed by the group itself. Its leak-site listings should be treated as claims: they indicate the group asserts it holds data belonging to the named organisation, but they do not by themselves prove the volume, sensitivity or authenticity of every file.

Who is Saint Mark Catholic Church?

Saint Mark Catholic Church is a Catholic parish—an ordinary place of worship and community gathering that serves its local congregation through Mass, sacraments, religious education, charitable work and pastoral care. Churches of this kind routinely maintain records needed for membership, baptism and marriage registers, donation and stewardship tracking, volunteer coordination, and internal administration. They may also hold contact details for parishioners, notes related to pastoral counselling, and financial or vendor information required to keep the parish running.

A breach affecting such an organisation is consequential precisely because the data is personal and often collected in a context of trust. People share names, addresses, family details and sometimes sensitive life events with their parish expecting confidentiality. Even a modest set of internal files can therefore touch many individuals who never considered themselves “customers” of a data-holding enterprise.

What data was at risk

The only data type explicitly named in connection with the incident is “internal files” said to have been exfiltrated in a ransomware attack. No inventory of those files, no confirmation of whether they included membership rolls, financial records, email archives or other categories, and no statement of volume have been made public. The number of people affected is recorded as unknown.

Organisations of this type typically hold contact and demographic information for parishioners and donors, sacramental and membership registers, contribution histories, staff and volunteer records, and routine administrative documents. It is reasonable to recognise that such material could have been among the internal files, yet it remains unconfirmed what was actually taken. Readers should therefore treat any specific category beyond the stated “internal files” as possible rather than proven.

Why it matters

When internal church files leave an organisation’s control, the practical risks are straightforward. Contact details and family information can be used for targeted phishing or social-engineering calls that appear to come from the parish itself. Financial or donation records, if present, can help criminals craft convincing fraud. Even routine administrative documents can reveal patterns of life—who is active in the community, who has recently experienced a death or illness, who holds keys or bank authority—that increase the chance of successful impersonation.

For the parish, the consequences include the cost and disruption of investigation and recovery, potential notification duties, and the harder-to-measure erosion of trust among people who shared information in good faith. Because the scale of the incident is undisclosed, the actual number of individuals who need to take protective steps is also unknown; caution is therefore warranted for anyone who has had a sustained relationship with the church.

Were you affected?

If you have been a parishioner, donor, volunteer or staff member at Saint Mark Catholic Church, treat the possibility of exposure seriously even though Reported Details are scarce. Monitor bank and credit-card statements for unfamiliar activity, and be sceptical of unexpected emails or calls that reference the parish or ask for money, credentials or personal details. Consider placing a fraud alert with the major credit bureaus if you believe financial data may have been involved. Change passwords for any accounts that reused credentials associated with church-related email, and enable multi-factor authentication wherever it is offered.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets. That step will not confirm or rule out involvement in this specific incident, but it can surface other exposures that deserve attention and give you a clearer picture of your overall digital footprint.

AICompiled with AI assistance from public sources and published under our editorial standards.