Moody Bible Institute Data Breach: Donor and Student Data Exposed

Moody Bible Institute is a Chicago-based Christian educational institution. In June 2026, threat actors affiliated with the ShinyHunters extortion group targeted the organization in a “pay or leak” campaign. According to Moody’s official disclosure, the institution’s Information Technologies Services team implemented security protocols to address the vulnerability upon discovering the incident, and Moody engaged both internal and external cybersecurity experts to conduct a forensic investigation and notified law enforcement.

Moody posted a public notice on June 22, 2026. Its notification letters, dated July 23, 2026 in the California sample, say its systems flagged unusual network activity on June 12, 2026, that information was taken on or about that date, and that the affected files were identified on June 23. The letters attribute the incident to a vulnerability in a software application commonly used by educational institutions. Personal data from the incident was later published online. ShinyHunters is a data-theft and extortion group known for large-scale data theft and public leak campaigns rather than traditional ransomware encryption. Moody was reportedly among several educational institutions targeted in a coordinated wave of attacks.

According to the exposure catalogued by Have I Been Pwned, over 2.3 million unique email addresses were published publicly, along with names, physical addresses, phone numbers, dates of birth, genders, marital statuses, and other information relating to donors, supporters, students, and alumni. Moody advised in its disclosure notice that it had engaged internal and external cybersecurity experts to investigate the matter.

The threat actor made broader claims about the volume and nature of the stolen data, including figures in the tens of millions of records. Those figures come from the attacker and have not been independently verified. Moody’s own filings go further. Its report to the Texas Attorney General lists names, addresses, dates of birth, Social Security numbers, driver’s license numbers and other government ID numbers, and Massachusetts’ 2026 breach report records Social Security and driver’s license numbers for the 942 Massachusetts residents notified. Each letter lists the details that applied to its recipient.

Because the exposed data relates to donors, supporters, students, and alumni, affected individuals span a wide community connected to Moody Bible Institute. Anyone whose email address, name, address, phone number, or date of birth was in Moody’s systems may be affected.

When contact details and dates of birth are exposed in a public leak, a primary risk is targeted phishing — messages crafted to look legitimate because they reference accurate personal details. Remaining skeptical of unexpected communications that reference Moody or your personal information is an important protective habit.

Be especially alert to phishing emails, calls, and texts that reference Moody Bible Institute or your personal details, and avoid clicking links or sharing information in response to unsolicited messages. Consider using a password manager and enabling multi-factor authentication on your important accounts, particularly if you reused any password associated with an exposed email address.

Monitor your financial and institutional accounts for unauthorized activity, and consider enrolling in the complimentary Kroll identity monitoring that Moody’s letters offer (one year in the California sample letter, two years in the Massachusetts version) before the deadline in your letter. If you receive a direct notification from Moody, keep it and follow its instructions. A legal professional can help you understand whether you may have legal options.

Readers following similar incidents can also see our overview of the MBE CPAs data breach lawsuit.