Education / Higher Education (Faith-Based) / Consumer / USA
Chicago-based Christian college and media ministry.
The Breach Risk Index (BRI) is a proprietary 0–100 score rating how dangerous a breach is right now, based on how recently the data has been circulating on the dark web and how valuable it is to attackers.
On June 15, 2026, ShinyHunters claimed a breach of Moody Bible Institute, alleging over 23 GB spanning enrollment, donor-relations, payroll and communications systems, including ~46 million communication records, ~2.2 million enrollment-lead records and 108,000+ biodemographic files. HIBP indexed over 2.3 million unique email addresses with names, postal addresses and dates of birth.
Full threat analysis, exploitation vectors, and principal guidance below.
10 additional sections · verified field analysis · defensive doctrine
2.3M rows records analyzed
Moody Bible Institute is a Chicago-based Christian college and media ministry offering undergraduate and graduate programs, broadcasting and publishing, with a large student, alumni and donor community.
A college and ministry holds student, alumni and donor identity and contact data, dates of birth, home addresses, enrollment-lead records and donor-relations and payroll data.
ShinyHunters added Moody Bible Institute to its leak site on June 15, 2026, claiming data across enrollment, donor, payroll and communications systems.
The breach exposed students, prospects, alumni and donors of a faith-based institution, raising FERPA and donor-trust concerns and prompting litigation.
An education-sector breach: student, staff and identity records support identity theft and targeted phishing. For a high-profile principal this is targeting-grade, not merely identity-theft-grade: the combination lets an adversary locate, impersonate, or pressure the principal with little additional work.
Motivation: Financial extortion, data sale
A prolific data theft and extortion group that began as a database theft and resale actor and evolved toward SaaS-focused extortion. Recent activity involves vishing, credential harvesting, SSO compromise, and theft of customer data from cloud and SaaS environments.
Enter your email to check whether your data appears in this breach. We’ll send a 6-digit code to confirm it’s your address.
Be the first to know when new breaches are disclosed. Free forever — confirm your email with a 6-digit code.
Executives, public figures, and high-visibility operators can receive tailored exposure intelligence and hardening guidance.
Request Consultation