First United Methodist Church Boerne targeted by interlock ransomware group

• Ransomware group: interlock
• Country: United States
• Sector: Retail & E-Commerce
• Announcement date: May 11, 2026

The interlock ransomware group has officially listed the First United Methodist Church Boerne on its leak site, claiming to have successfully exfiltrated sensitive information. According to the announcement made by the threat actors, the group has obtained a variety of personal and financial data belonging to the religious institution.

Details of the alleged attack

The threat actor known as interlock posted the listing on May 11, 2026, claiming that the breach occurred on the same day. While the group has not provided a specific ransom demand or a confirmed total file count, the shared screenshots provided by the attackers show file directories that indicate a total data volume of approximately 29 GB.

The group has explicitly blamed the incident on the institution's own negligence regarding data protection measures. This type of public shaming is a common tactic used by ransomware groups to pressure organizations into paying ransoms. By claiming that the breach was preventable, the attackers aim to increase the reputational pressure on the victim organization.

Alleged data contents and affected information

The data allegedly leaked by the interlock group is highly sensitive, as it involves not only the staff members of the organization but also the broader community it serves. The information reportedly includes various types of personally identifiable information (PII) and confidential documentation. The specific types of data mentioned in the leak include:

• Phone numbers
• Email addresses
• Home addresses
• Financial documents

The inclusion of such diverse data types suggests a comprehensive breach of the organization's digital environment, potentially impacting various departments and individual members of the community.

About First United Methodist Church Boerne

Located in Boerne, Texas, First United Methodist Church is a religious institution that provides worship services, educational programs, and community activities for various age groups. As a community-focused entity, it maintains a diverse database of individuals ranging from staff to parishioners and children.

Risk assessment and implications

This incident significantly increases the risk of identity theft and targeted phishing attacks for the individuals associated with the institution. Because the leaked data allegedly includes information belonging to children, the sensitivity of the situation is heightened, which may lead to significant legal implications for the organization. Given that the institution is located in the United States, it is likely that investigations under state-level data privacy regulations and relevant legislation may be observed.

Information regarding the interlock group remains limited. However, ransomware actors frequently employ double-extortion tactics, where they not only encrypt an organization's data but also threaten to publish it online to maximize leverage. The potential publication of this data could have a devastating impact on the institution's reputation. To mitigate such risks, organizations typically focus on robust data protection strategies, including regular backups, multi-factor authentication, and continuous monitoring of their networks to detect unauthorized access before data can be exfiltrated.