The California Office of the Attorney General disclosed a ransomware attack targeting Catholic Charities, Diocese of San Diego, discovered on March 30, 2020, with unauthorized access occurring between March 27 and March 30, 2020. The breach compromised highly sensitive personal data, including names, Social Security numbers, and medical information of affected individuals. Ransomware attacks typically encrypt critical systems, demanding payment for decryption, while simultaneously exfiltrating data for leverage or sale. In this case, the exposure of medical records and SSNs—both high-value targets for identity theft, fraud, and blackmail—poses severe long-term risks to victims, including financial harm, reputational damage, and potential healthcare fraud. The incident underscores the vulnerability of nonprofit and faith-based organizations, which often lack robust cybersecurity defenses despite handling vast amounts of sensitive data. The attack’s timing and the nature of the stolen data suggest a deliberate effort to maximize disruption and profit, aligning with trends where threat actors exploit sectors perceived as less prepared for sophisticated cyber threats.