Moody Bible Institute Data Breach Exposes 2.3M Personal Records in ShinyHunters Extortion Campaign
What Happened – In June 2026 the Moody Bible Institute was hit by a “pay‑or‑leak” extortion campaign run by the ShinyHunters group. Over 2,303,416 unique email addresses and associated personal data (names, physical addresses, phone numbers, dates of birth, gender, marital status) were publicly released. Moody confirmed the breach and engaged internal and external cybersecurity experts to investigate.
Why It Matters for Trust & Control Assurance
- This incident tests the effectiveness of data‑classification, access‑control, and monitoring controls that a continuous control‑assurance program must evidence.
- Demonstrating defensible audit‑ready logs of data handling and incident response is essential for privacy‑framework compliance.
- The breach underscores the need for a privacy‑focused control layer (e.g., consent management, DSAR readiness) that can be continuously validated.
Who Is Affected – Educational and religious nonprofit sector (students, alumni, donors, supporters).
Recommended Actions
- Conduct a privacy impact assessment and verify that data‑classification and handling policies cover the exposed data types.
- Strengthen access‑control and monitoring around donor and student records; ensure logs are retained for audit purposes.
- Review incident‑response playbooks, incorporate lessons learned, and document evidence for future compliance reviews.
Technical Notes – The breach was driven by an extortion campaign; the exact initial compromise vector was not disclosed. Exfiltrated data includes PII such as names, addresses, phone numbers, dates of birth, gender, and marital status. Source: https://haveibeenpwned.com/api/v3/breach/MoodyBibleInstitute