Ransomware gang Rhysida today took credit for a cyberattack earlier this month on First Baptist Church of Hammond in Indiana. Rhysida gave the megachurch one week to pay a ransom of 5 bitcoins, worth about $594,000 at time of writing.
First Baptist on July 15 announced a cyberattack breached the personal data of church staff, missionaries, and volunteers, including:
- Names
- Social Security numbers
- State-issued ID numbers
- Addresses
- Contact info
- Unique healthcare identifiers
- Dates of birth
- Health information for self-funded health plan claims processing
To prove its claim, Rhysida posted sample images of what it says are documents stolen from First Baptist. If First Baptist doesn’t pay, then Rhysida won’t hand over a decryption key to restore infected systems and threatens to sell the stolen data to the highest bidder.
First Baptist has not verified Rhysida’s claim. We do not know if the church did or will pay a ransom, how many people are affected, or how attackers breached its network. Comparitech contacted First Baptist Church of Hammond and will update this article if it replies.
“In July 2025, an unknown cyber actor accessed our computer network and used a virus to lock files stored on certain computer systems,” says the church’s July 15 notice (PDF) to victims. “The investigation into this matter is ongoing as of this update, and we do not have full details on what has occurred and how this impacts data stored on the computer network. Technical investigations are complex and take time to complete. We do not have an estimated date for completion at this time. The investigative challenges are also exacerbated by the computer virus locking the computers that contain evidence.”
The notice does not mention any offer of free credit monitoring or identity theft protection for victims, but such offers are usually only made after a breach investigation is complete.
Who is Rhysida?
Rhysida is a ransomware group that first surfaced in May 2023. Its ransomware can steal data and lock down targeted systems. It then demands a ransom both for deleting stolen data and for a key to restore infected systems. Rhysida operates a ransomware-as-a-service business in which affiliates pay Rhysida to use its malware and infrastructure to launch attacks and collect ransoms.
The group has taken credit for 89 confirmed ransomware attacks since it began, plus 122 unconfirmed claims that haven’t been publicly acknowledged by the targeted companies. Its average ransom demand is $805,000.
In 2025, Rhysida has claimed six confirmed attacks, including:
- The Oregon Department of Environmental Quality reported an April 2025 attack for which Rhysida demanded $2.6 million
- Germain aid organization Welthungerhilfe says it didn’t pay Rhysida’s $2.15 million ransom demand following a May 2025 attack
- Florida Lung, Asthma, & Sleep Specialists (FLASS) notified 10,000 people of a May 2025 attack for which Rhysida demanded $639,000
Ransomware attacks in the USA
Comparitech researchers have logged 233 confirmed ransomware attacks on American organizations in 2025 to date. Ransomware gangs made another 1,823 claims that haven’t been confirmed.
Other attacks on faith-based organizations include:
- Daystar Television Network notified 1,695 people of a June 2024 data breach claimed by Cactus
- Catholic Charities of Southern Nevada notified 73,822 people of a June 2024 breach claimed by Inc
Ransomware attacks can both steal data and lock down computer systems. Infected organizations must then decide whether to pay the ransom or face extended downtime, permanent data loss, and putting data subjects at increased risk of fraud.
About First Baptist Church of Hammond
Founded in 1888, First Baptist Church of Hammond is an independent fundamental Baptist megachurch in Indiana. It’s the largest church in Indiana and the 20th-largest in the USA, according to external sources. In addition to the church, First Baptist runs two K-12 schools and a non-accredited college for training pastors and missionaries. Throughout the 1990s and 2000s, the church was embroiled in multiple child sexual abuse scandals.
