Ransomware: qilin claims St Martha Catholic Church (US) — Consumer Services

On 18 July 2026, a ransomware group known as Qilin publicly claimed responsibility for a cyberattack against St. Martha Catholic Church in the United States, a consumer-facing religious organization. The claim was published on the ransomware.live leak site, indicating that sensitive data may have been exfiltrated. While this incident falls outside the EU’s direct jurisdiction, it serves as a critical reminder under the BREACH framework that ransomware attacks increasingly target smaller, non-profit entities with limited cybersecurity resources.

Organizations in the consumer services sector, particularly religious institutions, charities, and community-based non-profits, are directly affected. These entities often hold personal data of parishioners, donors, and volunteers, making them attractive targets. EU-based compliance teams should note that similar attacks could impact EU subsidiaries or data subjects if personal data of EU residents is involved, triggering GDPR notification obligations.

Compliance teams should immediately review their incident response plans, ensuring they include ransomware-specific procedures for data exfiltration and business continuity. Conduct a targeted risk assessment for third-party vendors and smaller affiliated organizations that may have weaker security postures. Finally, reinforce employee training on phishing and credential theft, as these are common initial access vectors for Qilin and similar groups.