Salvation Army USA Confirms Data Breach Which was Claimed by Chaos in March

• The Salvation Army USA confirms being hit by a ransomware attack
• The data breach was claimed by the Chaos group in March on their data leak site
• Ransom-related information or the amount of exposed data is not publicly known so far 

The Salvation Army USA, one of the world’s largest Christian charitable organizations in the USA, has officially confirmed that it suffered a data breach. The Chaos ransomware group began posting about their attack on the dark web in March.

According to a Claim Depot report, the data breach impacted employee and volunteer information. It is speculated that their Social Security numbers, name, address, date of birth, and driver’s license were exposed and exfiltrated by Chaos that declared the cybercrime on March 28, 2025.

Chaos threatened that the stolen information would be released soon if the ransom was not paid. The ransom amount has not been disclosed to the public. 

The organization operates in over 130 countries and supports food distribution, rehabilitation, and disaster relief shelters with nearly 7,000 centers in the United States. 

The class action law firm Shamis & Gentile P.A. is investigating the Salvation Army data breach

The Chaos ransomware was released in June 2021 and reflected fewer capabilities compared to others found at that time. Its earlier variants would wipe the data; however was later enhanced by its developers with encryption capabilities.

It targets both Linux and Windows systems and has been used to target critical infrastructure and sectors like manufacturing, energy, and healthcare. They were found gaining initial access by targeting IT staff, including those from AppSec, DevSecOps, and Blue teams, with fake security tools disguised as Acunetix software activators. 

In May 2022, reports suggested that its group members sided with Russian groups to continue their cyber activities. Its decryptors were offered online in June 2022, and at one point, however, there is no doubt that the group created other variants to extort victims with locked files.