The Salvation Army Listed by interlock Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 24 May 2025, The Salvation Army appeared on a leak site operated by the ransomware group interlock. The listing claims that internal files were taken in a ransomware attack. How many people may be affected remains unknown, and the precise contents of those files have not been publicly detailed. For anyone who has used the organisation’s services, donated, volunteered, or worked with it, the practical concern is straightforward: personal or operational information that was never meant to leave its systems may now be in the hands of criminals.

Public detail is limited. What is known so far is the claim of exfiltration and the date the listing was reported. That is enough to warrant careful attention from anyone whose contact with The Salvation Army could have placed their data inside the organisation’s networks.

Inside the incident

According to the reported information, The Salvation Army was listed by the interlock ransomware group on 24 May 2025. The group claims that internal files were exfiltrated during a ransomware attack. No confirmed figure for the number of people affected has been released. The method of initial access, the duration of the intrusion, the exact volume of data taken, and any ransom demand remain undisclosed in the available record. The listing itself is an assertion by the threat actor; independent confirmation of the full scope has not been provided in the facts at hand.

Ransomware incidents of this type typically involve encryption of systems combined with theft of data for leverage. Beyond the claim that internal files were removed, further technical specifics about this particular event have not been made public.

Who is interlock?

Interlock is a ransomware group that operates under a double-extortion model: encrypting systems while also stealing data and threatening to publish it if a ransom is not paid. Like other groups in this category, it maintains a leak site where it names victims and, in some cases, releases samples or full archives of stolen material. Public reporting on interlock has described it as targeting a range of organisations across sectors, often focusing on entities that hold sensitive operational or personal records and that may face pressure to restore services quickly.

The group’s listing of The Salvation Army is a claim made on that leak site. No additional statements attributed specifically to interlock about this victim—beyond the assertion of internal-file exfiltration—appear in the given facts. Readers should treat the listing as an unverified assertion until more independent information becomes available.

About The Salvation Army

The Salvation Army was established in 1865 and is a well-known international charitable organisation. It provides a wide range of social services, including food assistance, disaster relief, support for people with disabilities, outreach to the elderly and ill, clothing and shelter for those experiencing homelessness, and programmes for underprivileged children. In the course of this work it necessarily collects and stores information about clients, donors, volunteers, staff, and partner organisations.

A breach affecting such an organisation is consequential because the people it serves often include those in vulnerable circumstances. Contact details, case notes, financial assistance records, or identification documents—if present—could be especially sensitive. Even purely internal operational files can contain personal data or information that, if misused, could disrupt services or expose individuals to further harm.

What data was at risk

The available facts state only that internal files were exfiltrated in a ransomware attack. No further breakdown of data types—such as names, addresses, financial records, medical information, or employee details—has been disclosed. Organisations of this kind typically hold client service records, donor and volunteer information, staff personnel files, and operational documents. Whether any of those categories were among the files taken remains unconfirmed. Exact contents are therefore unknown, and no specific data elements should be assumed to may have been exposed.

What's at stake

For individuals whose information may have been involved, the risks are practical rather than abstract. Stolen contact details can be used for targeted phishing or social-engineering attempts that reference genuine prior dealings with The Salvation Army. If financial or identification data were present, identity theft or fraud become possible. Even without those elements, the mere fact of association with certain services can be sensitive and, if published, could cause distress or secondary harm.

For the organisation itself, the stakes include potential disruption of services, reputational damage, regulatory scrutiny, and the cost of investigation and remediation. Because the number of people affected is unknown and the precise data types unconfirmed, the full scale of impact cannot yet be measured. The uncertainty itself is part of the problem: people cannot take fully informed protective steps until more detail emerges.

If your data was in this claimed breach

If you have been a client, donor, volunteer, or employee of The Salvation Army and are concerned your information may have been involved, consider the following practical steps:

• Monitor financial accounts and credit reports for unexpected activity.
• Treat unsolicited emails, calls, or messages that reference the organisation with caution; verify any request through official channels before responding.
• Change passwords on accounts that reused credentials potentially linked to the organisation, and enable multi-factor authentication where available.
• Watch for phishing that uses knowledge of your past interactions with the charity.
• Keep records of any suspicious contact and report confirmed fraud to the relevant authorities.

Public detail on this incident remains limited. Readers can also run a free exposure scan of their email address to check whether their information has already appeared in known breach datasets. That check will not confirm or rule out involvement in this specific event, but it can surface other exposures that warrant attention.

AICompiled with AI assistance from public sources and published under our editorial standards.