npfy.org listed on Inc Ransom leak site

• Ransomware group: Inc Ransom
• Country: United States
• Sector: Education
• Announcement date: May 16, 2025

The Phoenix-based youth mentorship organization npfy.org has been listed on the leak site of the ransomware group known as Inc Ransom. The threat actor claims to have successfully targeted the non-profit entity, marking a potential significant data breach for the organization.

The claims made by Inc Ransom

According to a post published by the threat actor on May 16, 2025, the group claims to have obtained data belonging to npfy.org. The group's announcement suggests that the breach occurred around March 31, 2025. The threat actor has indicated that they have initiated a process regarding the potential publication of the compromised information, a common tactic used to pressure victims into meeting specific demands.

Ransomware leak sites serve as a platform for cybercriminals to host announcements regarding successful attacks. These sites are often used to shame organizations into paying ransoms by threatening to release sensitive information publicly. This method is a cornerstone of modern cyber extortion, where the threat of exposure is used as leverage against the victim.

Details of the alleged data breach

While the specific content of the leaked data has not been disclosed by the threat actor, the group claims to be in possession of a substantial amount of information. The announcement specifies a dataset size of 70 GB. No information was provided regarding the specific file count or the specific types of files contained within the dataset.

The listing names no specific data types that were compromised.

In many modern ransomware attacks, threat actors employ a strategy known as double extortion. In this scenario, the attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data before the encryption process begins. The goal is to threaten the victim with the public release of this data if the ransom is not paid. This tactic increases the pressure on the victim, as the loss of confidentiality can lead to long-term reputational and legal consequences, even if the organization can successfully restore its systems from backups.

Organization profile

New Pathways for Youth is a non-profit organization based in Phoenix, Arizona. The organization provides comprehensive mentorship programs for youth, aiming to support the personal development of young people. Their mission includes helping individuals graduate from high school and providing the necessary support to pursue post-secondary education.

Implications and sector risks

This incident may pose a significant risk to data privacy within the education and mentorship sector. Because the organization is based in the United States, it may be subject to various state-level data protection laws and federal regulations. The potential presence of sensitive information regarding the youth mentored by the organization may exacerbate the severity of the incident.

The use of double-extortion tactics by Inc Ransom suggests that the compromised data could be utilized for secondary risks, such as identity theft or targeted phishing campaigns. When sensitive personal information is leaked, it can be harvested by other malicious actors to conduct highly convincing social engineering attacks against the individuals involved.

For organizations operating in the education and non-profit sectors, maintaining robust cybersecurity postures is essential. Common defensive steps include implementing multi-factor authentication (MFA) across all services, maintaining regular and offline backups, and conducting regular security awareness training for staff. Additionally, organizations should focus on data minimization—ensuring that only the necessary amount of sensitive information is collected and stored—to reduce the potential impact of a future breach.