Habitat for Humanity of Greater Sioux Falls, Inc. targeted by Qilin ransomware group

• Ransomware group: Qilin
• Country: United States
• Sector: Government & Defense
• Announcement date: June 26, 2025

Qilin ransomware group claims data breach at Habitat for Humanity of Greater Sioux Falls, Inc.

The threat actor known as Qilin has listed Habitat for Humanity of Greater Sioux Falls, Inc. on its dedicated leak site, alleging that the organization has suffered a data breach. This announcement, made on June 26, 2025, indicates that the group is utilizing its platform to claim responsibility for the incident and to exert pressure on the victim organization.

Details of the alleged attack

According to the claims made by the Qilin group, the threat actors gained unauthorized access to the organization's network following an incident that reportedly occurred on May 9, 2025. The group is employing a double-extortion strategy, a common tactic used by modern ransomware operators. In such a scenario, attackers do not merely encrypt an organization's files to disrupt operations; they also steal sensitive information before the encryption occurs. The threat of leaking this stolen data on a public leak site serves as a secondary method of coercion, intended to force the victim into paying a ransom to prevent the public disclosure of their private information.

Data involved in the leak

The information released by the group includes samples that appear to belong to the organization's employees or applicants. Based on the visual evidence provided by the group, the compromised data includes various types of sensitive documentation. The following types of data are identified as being affected:

• Identity information
• Financial data
• Employee data

The samples displayed by the attackers include identification cards, financial records, and various tables containing personal information.

About Habitat for Humanity of Greater Sioux Falls, Inc.

Habitat for Humanity of Greater Sioux Falls is a non-profit organization dedicated to building, preserving, and advocating for affordable housing to improve the quality of life in the community. It operates in the Sioux Falls area of South Dakota, providing support to families in need of adequate shelter.

Risk assessment and potential consequences

This incident may increase the risk of identity theft and fraud for the organization's employees and the individuals it serves. Because the organization operates within the United States, it may face notification obligations under state-level data privacy laws and potential federal regulations. The nature of the leaked data, which includes identity and financial information, presents a significant risk to the privacy of the individuals involved.

The past activities of the Qilin group suggest that the leaked data could be utilized in secondary attacks or targeted phishing campaigns. Such campaigns often use the stolen information to craft highly convincing messages designed to trick individuals into revealing even more sensitive credentials or funds. Furthermore, the organization may observe negative impacts on its operational continuity and its reputation management due to the public nature of the leak.

While information regarding the specific capabilities and motives of the Qilin group remains limited, the use of double extortion highlights the evolving threat landscape facing non-profit organizations. Organizations in this sector often manage sensitive personal and financial data, making them attractive targets for threat actors seeking to maximize their leverage through public exposure.