In March 2025, the ransomware group Chaos claimed to have stolen sensitive data from the Salvation Army and warned that the “[d]ata will be released soon.”

While the Salvation Army has not acknowledged the potential data breach or provided any information to victims or the public, an alleged sample of the stolen data posted by Chaos suggests that the stolen information contains the personal information of over 100,000 employees and 1.4 million volunteers.

Class action lawsuits have been filed in the United States, alleging that the Salvation Army failed to implement adequate cyber-security measures and failed to provide timely notice to victims that their personal information was subject to unauthorized access.

Once stolen personal information such as name, date of birth, address, and Social Insurance Number is released to the dark web, there is a significant risk of identity theft and other forms of personal, social, and financial harm. This risk generally remains for the lifetime of the victim. Immediate action is required by the individual such as enabling credit monitoring and reviewing financial accounts to mitigate potential fraudulent activity.

The Salvation Army operates in 134 countries and provides essential services like disaster relief, housing, and rehabilitation support. It ranks among the largest nonprofits globally.

If you believe you may have been impacted by this breach or would like to learn more about the Salvation Army data breach, please contact Slater Vecchio LLP here.