Goodwill targeted by Interlock ransomware group

• Ransomware group: Interlock
• Country: United States
• Sector: Retail & E-Commerce
• Announcement date: March 26, 2026

The ransomware group known as Interlock has published an announcement on its leak site claiming responsibility for a cyberattack against Goodwill. In the post, the threat actors allege that they have successfully targeted the organization and have gained access to sensitive information. This claim follows a common pattern observed in modern cyber extortion, where groups use public leak sites to pressure victims by threatening to release stolen data.

The claimed attack event

According to the announcement published on March 26, 2026, Interlock claims to have targeted Goodwill due to alleged negligence in the organization's security measures. The group asserts that these security deficiencies allowed them to compromise various types of sensitive information. To support their claims, the threat actors provided screenshots displaying directory structures that appear to belong to the organization.

The shared visual evidence suggests that the attackers accessed several critical areas within the organization's digital environment. The directory structures shown in the screenshots are related to the accounting department, the IT department, and various backup files. This type of visibility is often used by ransomware groups to demonstrate the depth of their access and to validate their claims of a successful breach.

Data involved in the breach

The information provided by the Interlock group suggests a significant scope of data compromise. Based on the screenshots and the group's claims, the stolen data includes a variety of sensitive files and records. Specifically, the leaked content is said to include accounting records, Azure reports, backup files, Excel reports, and various data sets belonging to the IT department.

The group claims that the following categories of data have been compromised:

• Employee personal data
• Partner data
• Financial documents

The presence of such diverse data types, ranging from administrative IT files to sensitive financial and personal records, highlights the potential impact of the incident on the organization's internal and external operations.

About Goodwill

Goodwill Industries of North Central Pennsylvania is a non-profit organization dedicated to turning donations into jobs. The organization operates across Pennsylvania and New York, supporting community development by providing employment opportunities to individuals in the region.

Potential impact and organizational risks

This incident may pose secondary risks such as identity theft or targeted phishing attacks for the organization's employees and partners. Because the stolen data includes personal information, the individuals involved may be at a higher risk of being targeted by subsequent social engineering campaigns. Furthermore, the leakage of financial documents could have negative impacts on the commercial operations of the organization.

As the organization operates in the United States, it may face legal processes under state-level data protection laws and potential notification obligations. The publication of the data may lead to reputational damage and operational disruptions for the organization. While public information about the Interlock group remains limited, the act of publishing data on a leak site is a hallmark of double extortion tactics.

In double extortion, attackers not only encrypt an organization's systems but also steal sensitive data to use as leverage during ransom negotiations. To defend against such threats, organizations in the retail and non-profit sectors often implement defensive steps such as robust multi-factor authentication, regular security awareness training for employees, and comprehensive data encryption protocols. Maintaining offline, tested backups and implementing strict access controls for sensitive directories, such as those belonging to accounting and IT departments, are also critical components of a modern cybersecurity posture.