Ransomware victim disclosure

Southeastern Conference of Seventh-day Adventists

Claimed by NIGHT SPIRE · listed 18 hours ago

600 GB

Data size

Today

Age

since listed · listed for ransom

Status timeline

Listed
Jun 6, 2026

Current state: Listed for ransom

At a glance

Group: NIGHT SPIRE
Status: Listed for ransom
Country: US
Sector: Religious Organization
Listed on leak site: Jun 6, 2026
Data size: 600 GB

About the victim

AI dossier — public-source company profile

The Southeastern Conference of Seventh-day Adventists (SECSDA) is a regional administrative body of the Seventh-day Adventist Church serving the southeastern United States. The organization coordinates ministries, events, disaster response training, and community services across its member churches and institutions.

Industry: Religious Organization

Attack summary

Severity: medium — Confirmed exfiltration of sensitive organizational data including financial records, HR data, and employee PII at scale (600 GB). However, the leak post shows 'Data is not available now' for the SECSDA entry specifically, indicating proof may have been removed or was never publicly displayed. The organization is not a regulated financial or medical entity, limiting critical classification despite significant data exposure.

NIGHT SPIRE claims to have exfiltrated approximately 600 GB of data from SECSDA, including financial documents, HR records, banking information, employee personal data, and organizational records. The group listed the victim on their leak site but indicates that proof files are no longer available.

medium

Data the group says was taken

AI dossier — extracted from the leak post

Financial documents and records
HR data and employee personal information
Banking and accounting records
Tax returns and QuickBooks files
Employee email and SMS data
Contracts and proposals
Technical and business strategy documents
Database backups (MSSQL)

The leak post

captured from the group's site

- Financial Documents- HR Data- Supervisor's Information
Data is not available now.
Data is not available now.
Data is not available now.
[la familia adualt day center](http://www.lafamiliaadultdaycenter.com)
Data is not available now.
Data is not available now.
- QuickBooks Files- Scanned tax returns- Proposal, Contrats- QuickBooks automated backups
- Banking & Financial Records- Personal data- Critical POS Data
- Banking & Financial Data- Accounting & Tax Records
- Financial & Accounting Records- Human Resources- Sales & Marketing
- Sales Related Documents- Human Resources- Sensitive Employee Records- Email and SMS Data
Data is not available now.
- Technical Documents- Financial Sheets- Contracts & Invoices- Business strategy files
- MSSQL-DB- HR Documents- Contracts
Data is not available now.
[Progressive Oral Surgery & Implantology](http://nspirep7orjq73k2x2fwh2mxgh74vm2now6cdbnnxjk2f5wn34bmdxad.onion/progressiveoralsurgery.com)
- Patients Information Records- Financial Records
[The Country Club of Darien](http://nspirep7orjq73k2x2fwh2mxgh74vm2now6cdbnnxjk2f5wn34bmdxad.onion/CCDarien.org)
- Sales / agent / commercial operations- Industrial / manufacturing / tooling business dat…

Screenshot of the leak post

Leak screenshot for Southeastern Conference of Seventh-day Adventists

Sources

Victim sitehttps://www.secsda.org/
Leak posthttp://nspirep7orjq73k2x2fwh2mxgh74vm2now6cdbnnxjk2f5wn34bmdxad.onion/database

Source

Indexed 18 hours ago

This page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.

Is this your supplier? Your competitor? You?

Pro plans monitor your domain, corporate emails, and crypto wallets across every new ransomware leak-site post, breach dump and Telegram callout — alerts within 5 minutes.

Disclosure context

About NIGHT SPIRE

NIGHT SPIRE is a ransomware group first observed in June 2026 with an apparent primary motivation of financial gain, having claimed at least 14 known victims across multiple continents within a relatively short operational window. Given the group's recent emergence and limited public documentation by major threat intelligence organizations such as CISA, FBI, or Mandiant at this time, a comprehensive technical profile cannot be fully established from open sources. Their targeting pattern, based on available victim data, reflects a geographically diverse focus spanning the United States, Singapore, Brazil, Panama, and Spain, suggesting either an opportunistic targeting approach or a deliberate strategy to operate across jurisdictions that complicate law enforcement coordination. The sectors most frequently impacted include Healthcare, Recruitment and Staffing, Hospitality and Recreation, Commerce and Trade, and Automotive, indicating the group likely targets organizations perceived as having lower cybersecurity maturity or higher operational pressure to restore services quickly, both of which increase ransom payment likelihood. No confirmed affiliations to known ransomware-as-a-service ecosystems, nation-state actors, or predecessor groups have been publicly documented as of this writing. NIGHT SPIRE's operational status as of mid-2026 reflects an active and emerging threat actor, and the breadth of their targeting across critical and commercially sensitive sectors warrants continued monitoring by defenders, particularly those operating in the identified high-risk verticals and geographies. The group has been linked to 14 public disclosures across our corpus. First observed on a leak site on June 6, 2026. The operation is currently active.

Also tracked as: nightspire.

Timeline of this disclosure

June 6, 2026Southeastern Conference of Seventh-day Adventists listed by NIGHT SPIREon the group's public leak site

Data size: 600 GB