The Salvation Army listed on interlock ransomware leak site

• Ransomware group: interlock
• Country: United States
• Sector: Government & Defense
• Announcement date: December 24, 2025

The Salvation Army targeted by interlock ransomware group

The Salvation Army has been listed on a leak site by the ransomware group known as interlock. According to the announcement made on December 24, 2025, the group claims to have gained unauthorized access to the organization's systems and subsequently published data belonging to the entity.

Claims regarding the incident and data volume

The interlock group claims to have published data belonging to The Salvation Army on their leak site. It is alleged that the data was obtained following an incident that reportedly occurred on May 27, 2025. The group claims to have made a total of 93.6 GB of data accessible to the public through their platform.

The group's announcement includes a screenshot that displays a folder named 'DataBases' with a size of 93.6 GB, along with two small files named DATA_INFO and tree. While the volume of the data is specified, the exact nature of the leaked data has not been explicitly specified by the group.

Affected data types

• Database files

About The Salvation Army

The Salvation Army, founded in 1865, is an international Christian charitable organization. The organization provides food, shelter, and social services to the poor, homeless, and disaster victims worldwide.

Analysis and potential risks

Public information regarding the interlock group is limited. The presence of database files suggests that sensitive information belonging to the individuals served by the organization may be at risk of exposure. Given the organization's focus on social services, this could lead to secondary risks such as identity theft or targeted phishing attacks.

As a United States-based organization, a potential data breach may be subject to state-level privacy regulations. It is important to note that the accuracy and scope of the data have not yet been verified by independent sources.

In the context of modern cyber threats, ransomware attacks often involve a tactic known as double extortion. In these scenarios, threat actors do not only encrypt an organization's data to demand a ransom for the decryption key, but they also steal sensitive information to threaten its public release. This pressure is intended to coerce the victim into paying the ransom to prevent the exposure of confidential records.

For organizations operating in the social services and non-profit sectors, protecting sensitive data is a critical component of operational security. Such organizations often handle highly personal information regarding vulnerable populations, making them attractive targets for cybercriminals. To mitigate these risks, organizations typically implement defensive measures such as multi-factor authentication, regular security awareness training for staff, and robust encryption for data at rest and in transit. Furthermore, maintaining comprehensive, offline backups and implementing strict access controls are standard industry practices to defend against unauthorized access and data exfiltration.