Boise Rescue Mission Ministries listed on ALPHV ransomware leak site

• Ransomware group: ALPHV
• Country: United States
• Sector: Government & Defense
• Announcement date: October 16, 2023

ALPHV claims data breach at Boise Rescue Mission Ministries

On October 16, 2023, the ransomware group known as ALPHV (also referred to as BlackCat) published an announcement on its leak site claiming to have compromised the systems of Boise Rescue Mission Ministries. The group alleges that they successfully gained unauthorized access to the organization's internal systems and subsequently exfiltrated various sensitive datasets. This announcement was made public by the threat actors to highlight the alleged breach and to publicize the organization's activities.

The incident involves a high-profile ransomware group that is widely recognized in the cybersecurity landscape for utilizing Rust-based malware. ALPHV is known for employing double-extortion tactics, a method where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release unless a ransom is paid. This dual pressure increases the complexity of incident response for the targeted entities.

Details of the alleged data exfiltration

The announcement made by ALPHV claims that a vast array of sensitive information has been stolen. According to the group's claims, the stolen data includes highly personal information belonging to both employees and the individuals served by the organization. The breadth of the alleged theft covers administrative, financial, and highly confidential personal records.

The specific types of data allegedly involved in the breach include:

• Employee Social Security Numbers (SSNs)
• Employee dates of birth
• Employee contracts
• Drug test results
• Passport scans
• ID scans
• Guest forms
• Specialist reports
• Financial documents
• Tax forms

The inclusion of such sensitive identifiers as Social Security Numbers and passport scans suggests a significant potential for misuse by the threat actors.

About Boise Rescue Mission Ministries

Boise Rescue Mission Ministries is a non-profit organization located in the United States. Since 1958, the organization has been providing essential services to those in need within the Treasure Valley area of Idaho. Their mission involves offering food, shelter, clothing, counseling, and education to vulnerable populations. The organization operates through a faith-based approach to provide community support to the local area.

Impact and security implications

The alleged breach poses a high risk of identity theft and fraud for both the employees of the organization and the individuals who rely on its services. The exposure of highly sensitive personal data, such as passport scans and Social Security Numbers, can lead to long-term security risks for the affected individuals, as these identifiers are difficult to change and are primary targets for fraudulent activities.

Because the organization is based in the United States, this incident may trigger specific legal obligations. Depending on the nature of the data and the residency of the affected individuals, the organization may face mandatory data breach notification requirements under relevant state laws and federal regulations. Such regulations are designed to ensure that victims are informed of the risk to their personal information so they can take protective measures.

For organizations operating in the non-profit and community service sectors, such incidents can have a devastating impact on operational processes and institutional reputation. To mitigate such risks, organizations typically focus on robust defensive measures. These include implementing multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular security awareness training for staff. Furthermore, ensuring that sensitive data, such as identity documents and financial records, is encrypted both at rest and in transit is a fundamental component of a modern security posture. Given the sensitivity of the data claimed to be stolen in this instance, the potential for long-term operational and reputational damage is assessed to be significant.