First Baptist Church of Hammond listed on Rhysida ransomware leak site

• Ransomware group: Rhysida
• Country: United States
• Announcement date: July 29, 2025

The First Baptist Church of Hammond has been listed on the leak site associated with the Rhysida ransomware group. According to an announcement made on July 29, 2025, the threat actor group claims to have successfully targeted the institution, marking a recent addition to the group's public list of victims.

The claimed attack and method

The Rhysida group has published a leak announcement claiming to have compromised data belonging to the First Baptist Church of Hammond. The group alleges that they gained unauthorized access to the institution's network, which allowed them to exfiltrate various documents from the internal systems. This breach is being framed through the lens of a double-extortion strategy.

In a double-extortion scheme, ransomware groups do not merely encrypt an organization's files to disrupt operations. Instead, they focus heavily on data exfiltration. By stealing sensitive information before deploying encryption, the attackers create a secondary layer of leverage. They threaten to publish the stolen data on public leak sites if the ransom demand is not met, thereby pressuring the victim through the threat of reputational damage and regulatory scrutiny.

Data involved in the claim

The announcement includes visual evidence to support the group's claims. Screenshots provided by the attackers appear to show samples of various sensitive documents. These samples include identification cards, personal documents, and various forms that appear to belong to the institution's staff or members.

Based on the information provided in the leak announcement, the following types of data are reportedly involved:

• Identity information
• Personal documents

While the group has provided these samples, no specific information was given regarding the total size of the data stolen or the exact file count. Furthermore, no specific ransom demand has been disclosed in the public announcement.

About the First Baptist Church of Hammond

The First Baptist Church of Hammond is a prominent Baptist church located in Hammond, Indiana, United States. Established in 1887, the institution has a long-standing history in the region. Notably, it was listed as the 12th largest church in America by Outreach magazine in 2009.

Impact and organizational implications

This incident may pose secondary risks such as identity theft and fraud for the institution's members and employees, given the nature of the documents shown in the leak samples. Because the organization is based in the United States, the breach may trigger legal processes under state-level data protection laws and specific notification requirements designed to protect citizens.

The use of the double-extortion method by the Rhysida group threatens not only the confidentiality of the data but also the operational continuity of the institution. When sensitive information is leaked, the damage extends beyond the immediate technical disruption caused by ransomware, potentially affecting the trust between the institution and its community.

In such scenarios, it is likely that an organization will need to conduct a thorough forensic investigation to determine the full scope of the breach and identify exactly which individuals were affected. Determining the extent of the unauthorized access is a critical step in responding to the threat and fulfilling any necessary notification obligations to the affected parties.

General defensive considerations

To defend against such threats, organizations typically focus on strengthening network security and implementing robust monitoring to detect unauthorized access or large-scale data transfers. Implementing strict access controls and multi-factor authentication can help mitigate the risk of initial entry, while regular backups and data encryption can assist in maintaining operational continuity and protecting the confidentiality of sensitive information.