Moody Bible Institute Data Breach (June 2026)

What Happened

The leak site tracker ransomware.live first recorded ShinyHunters' leak site listing for Moody Bible Institute on June 15, 2026, and the listing gave Moody until June 18 to reach out before the group leaked its data. CyberInsider reported on June 18 that the group claimed more than 23 GB of data from enrollment, donor relations, payroll and communications systems, and The Register reported that the group cited a PeopleSoft breach in its details about the attack and that the files were made available for download on June 23. According to the Have I Been Pwned entry, the published data relates to donors, supporters, students and alumni, and Have I Been Pwned loaded 2,303,416 unique email addresses from it on July 3, 2026.

Moody's statement to CyberInsider, published June 18, said it was "aware of a claim of data breach" and had engaged its cyber security experts to investigate. Its Data Incident Investigation notice, dated June 22, says Moody was "among several colleges and universities" where cyber criminals claimed they had hacked into certain internal systems, that its Information Technologies Services team implemented security protocols to address the vulnerability, and that Moody "engaged both internal and external cybersecurity experts to thoroughly investigate the matter" and notified law enforcement.

Moody's later notification letter, dated July 23, 2026 and filed with the California Attorney General, says its cybersecurity system alerted it to unusual activity on its computer network on June 12, that information was illegally acquired from its system on or about that date, and that the incident "was caused by a vulnerability in a software application that is commonly used by educational institutions." In a July 31 announcement, Moody said the files it identified on June 23 contained some individuals' names, dates of birth, Social Security numbers, driver's license numbers, other government identification numbers and financial aid information, that most of the files can only be viewed with specialized software, and that it was notifying potentially affected individuals in line with the relevant notification laws.

The Washington Attorney General's directory records the notice as reported on July 23, 2026, with 8,955 Washingtonians affected and Social Security numbers, driver's license or Washington ID card numbers and full dates of birth among the information compromised. The letter offers a complimentary one-year Kroll identity monitoring membership, with enrollment open until October 26, 2026.

What Was Exposed

7 classes of data across 2,303,416 records, per Have I Been Pwned, Moody Bible Institute breach entry: dates of birth, email addresses, genders, marital statuses, names, phone numbers and physical addresses.

Names, dates of birth, home addresses, phone numbers and email addresses together let a scammer pose convincingly as Moody in a donation appeal, an alumni message or an enrollment follow-up. Moody's July 31 announcement says the files also held some individuals' Social Security and driver's license numbers, so anyone who received its notification letter should freeze their credit at all three bureaus.

What to Do If You Are Affected

The full sequence, and what to do in what order, is in what to do after a data breach.

What Is Not Known Yet

Which software application had the vulnerability, how many people Moody is notifying in total, and whether the files its July 23 letter describes are the data ShinyHunters published. Neither that letter nor Moody's July 31 announcement mentions ShinyHunters.