Moody Bible Institute breach leaves 2.3M accounts needing salvation, says cyber expert

More than 2.3 million records tied to Moody Bible Institute (MBI) appeared on a leak site after the Christian college disclosed it had been targeted by the extortion gang ShinyHunters. The incident first came to light in June when MBI notified affected parties, and the group followed through on its threat by releasing the material. Have I Been Pwned subsequently catalogued the cache, confirming the scale of the exposure.

ShinyHunters leaked the stolen data on June 23. Files offered for download contained names, genders, dates of birth, street and email addresses, telephone numbers, and marital statuses. Additional material covered donor relations along with information on supporters, current students, and former pupils.

MBI has issued no further statements since June 22, one day before the files surfaced. The college reported that its internal technology staff had closed off the exploited weakness and that outside incident response specialists had been retained.

MBI urged monitoring and protective steps. The institution encouraged anyone connected to it to watch their financial accounts closely and to place free credit freezes plus fraud alerts while its probe continued. "Throughout this process, we are grateful for the Lord's faithfulness and for the dedicated teams and outside experts working tirelessly to protect our ministry and those we serve," said MBI.

"We are confident that God remains sovereign over every circumstance, and we trust Him to grant wisdom and discernment as we navigate this situation together," the organization added.

ShinyHunters has listed 86 victims since January. The true total for 2026 is probably larger because any organization that paid the demanded ransom would have its name taken off the public tally. The crew has previously been tied to notable operations against Salesforce, Carnival, and Pitney Bowes.

ShinyHunters has also claimed that an Oracle PeopleSoft campaign affected more than 100 organizations and cited a PeopleSoft breach in the details about its attack on MBI. National security alerts were issued about ShinyHunters earlier in the year following its attack on learning platform Canvas, which compromised the data of an estimated 275 million students.

MBI operates multiple ministries. Its flagship university provides undergraduate, graduate, and remote classes aimed at those preparing for religious vocations, together with flight training that incorporates theological study. More than 250,000 students have studied at MBI since it was first established in 1886.

The institute also runs Moody Radio, a Christian radio network and station, and a publishing arm devoted to Christian literature. The leak indicates the group's pay-or-leak demands went unmet.