Colonial Presbyterian Church Listed by Pear Ransomware Group

On April 7, 2026, Colonial Presbyterian Church appeared on the leak site of the pear ransomware group. The Kansas City-area congregation, which runs campuses in Overland Park and South Kansas City, is claimed to have had internal files exfiltrated during a ransomware attack. While the precise number of people whose personal information may have been exposed remains unknown, any church member, donor, employee, or vendor whose records were stored in those systems could now be at risk.

What Public Reporting Shows

Public reporting indicates the church’s internal documents were stolen and are now hosted on the pear group’s onion site. The breach stems from a ransomware incident in which attackers gained access, exfiltrated data, and later listed the organization when demands were not met. Available details confirm the victim operates two physical locations in the Kansas City metro area but do not yet specify the exact volume or sensitivity of the files released. Industry research from sources such as DoxxScan™ continuous monitoring has not yet catalogued this leak, which is typical for fresh ransomware postings.

Why This Matters for You and Your Family

Churches hold detailed records on families: addresses, phone numbers, email accounts, dates of birth, children’s names, donation histories, and sometimes Social Security numbers for employees or tax purposes. When those records are stolen, the information can be sold or published in ways that affect your daily life. A single exposed email or phone number tied to your family’s church profile can serve as the starting point for phishing campaigns, identity theft, or unwanted contact. For parents, the risk extends to children whose names and ages appear in youth-group lists or family directories.

The Doxxing and Identity-Chain Implications

Stolen church files rarely stay isolated. Attackers and data brokers routinely combine them with other leaks to build detailed profiles. An email address from the church database can be matched to gaming accounts, social-media handles, or school records, creating an identity chain that leads directly to your home. This linkage turns a single breach into repeated harassment or targeted scams. Credential leaks like this one frequently cascade into account takeovers, especially for families whose children use the same email for Roblox, Minecraft, or other online games.

What to Do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup to remove what you can.
• Rotate any password you ever used at the church or related services anywhere it has been reused, and switch to 2FA through an authenticator app instead of text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your family’s data is caught in hours rather than months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same address or parent email.
• Let remediation specialists handle takedown requests across data brokers and leak sites for you while you focus on securing your own accounts.

The incident shows how quickly personal information held by trusted community organizations can reach threat actors. Taking concrete steps now limits how far the stolen data can travel. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that connects handles to real identities, and hands-on remediation by specialists; its household coverage also protects children’s gaming accounts that frequently become targets once a family link is established.