Two Saints Listed by noescape Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 25 October 2023, the organisation Two Saints was listed by the ransomware group known as noescape. Public reporting indicates that internal files were exfiltrated in a ransomware attack, though the number of people affected remains unknown and further technical details have not been disclosed. The listing itself constitutes a claim by the group rather than an independently confirmed account of the full scope of the incident.

Two Saints provides support services across parts of southern England, including outreach to people sleeping rough and supported accommodation. Any compromise of internal systems at an organisation of this kind raises practical concerns for the people who rely on its services and for the staff who deliver them, even when the precise contents of the taken data have not been made public.

What happened

According to the available record, Two Saints was named on the leak site associated with the noescape ransomware group on or around 25 October 2023. The report states that internal files were exfiltrated during a ransomware attack. No public figure has been given for the volume of data, the number of individuals whose information may be involved, or the exact date the intrusion began. The method of initial access, the duration of any attacker presence inside the network, and whether encryption was also deployed have not been detailed in the material available. As with many such listings, the group’s claim of responsibility and of data theft stands as an assertion pending any fuller confirmation or clarification from the organisation itself.

Who is noescape?

noescape is a ransomware operation that became active in 2023. Like several contemporaneous groups, it has followed a double-extortion model: encrypting systems where possible while also copying data and threatening to publish it if a ransom is not paid. The group has maintained a dark-web leak site on which it names organisations it claims to have compromised and, in some cases, releases samples or larger sets of stolen files. Public reporting on noescape has described typical ransomware tactics—phishing, exploitation of remote-access services, and lateral movement inside networks—though the precise techniques used against any single victim are rarely confirmed in open sources. Listings on such sites should be treated as claims by the actors rather than verified incident reports; groups have incentives to exaggerate or misattribute activity.

About Two Saints

Two Saints is a UK-based organisation whose services are located in Berkshire, Hampshire, the Isle of Wight, Portsmouth and Southampton. Its work includes outreach to people who are sleeping rough and the provision of supported accommodation, among other forms of assistance for individuals facing housing insecurity or related hardship. Organisations operating in this sector routinely hold personal details necessary to deliver care and housing support—contact information, case notes, referral records, and sometimes health or financial circumstances—because those details are required to assess need and coordinate help. A breach affecting such an organisation is consequential precisely because the people it serves are often already in vulnerable situations; unauthorised exposure of their information can compound existing difficulties even when the full inventory of taken data remains unconfirmed.

What data was at risk

The public facts state only that internal files were exfiltrated in a ransomware attack. No itemised list of data categories, file counts, or named individuals has been released in the material provided. Organisations that deliver rough-sleeping outreach and supported accommodation typically maintain records containing names, addresses or last-known locations, contact details, dates of birth, support plans, multi-agency referral information, and sometimes sensitive notes about health, benefits or personal circumstances. It is reasonable to expect that some combination of operational and personal data existed inside Two Saints’ systems; however, whether any particular category was among the files taken has not been confirmed. Readers should therefore treat the exact contents as unconfirmed.

Why it matters

For individuals who have used Two Saints’ services, the principal risk is that personal information—if it was among the exfiltrated files—could be misused for fraud, impersonation, or unwanted contact. People experiencing homelessness or housing instability may have fewer resources with which to monitor accounts or reverse identity-related harm, making any exposure more burdensome. For the organisation, a ransomware incident can disrupt day-to-day service delivery, divert staff time toward incident response and recovery, and erode trust among service users and partner agencies. Even when encryption is not confirmed or systems are restored, the mere possibility that internal files left the network creates ongoing uncertainty until the full picture is clearer. Because the number of people affected is unknown, the practical scale of any individual impact cannot yet be stated.

What to do if you're exposed

If you have been a client, resident or staff member of Two Saints and are concerned your information may have been involved, begin by watching for unexpected contact, unusual account activity or requests for personal details that appear to reference your history with the organisation. Consider placing fraud alerts with relevant credit-reference services and reviewing any online accounts that share the same email address or password you may have used in communications with support services. Keep records of any suspicious correspondence. You can also run a free exposure scan of your email address to check whether it has already appeared in known breach datasets; such checks do not confirm involvement in this specific incident but can indicate whether your details have surfaced elsewhere and help you prioritise further protective steps.

AICompiled with AI assistance from public sources and published under our editorial standards.