Data on more than 2.3 million people associated with Moody Bible Institute (MBI) has been exposed online after the Christian college was targeted by ShinyHunters
The attack was first disclosed by MBI in June, and the extortion crew later leaked the stolen data. Have I Been Pwned has since added the cache to its breach notification database, putting a figure on the number of exposed accounts
MBI is one of many victims of ShinyHunters’ pay-or-leak attacks in 2026, and while the organization has not explicitly commented on whether it negotiated with the criminals, the leak suggests that the group’s extortion demands were not met
Broadly consistent with ShinyHunters’ claims, the MBI data made available for download on June 23 includes names, genders, dates of birth, physical and email addresses, phone numbers, and marital statuses
The cache also included documents concerning donor relations, MBI’s supporters, students, and alumni
MBI has not spoken publicly since June 22, the day before ShinyHunters leaked its files.
The organization stated that its tech team had addressed a vulnerability and brought in external cybersecurity experts to help with its incident response.
It urged those affiliated with MBI to monitor their accounts and make use of free credit freezes and fraud alerts until it had completed its investigation
“Throughout this process, we are grateful for the Lord’s faithfulness and for the dedicated teams and outside experts working tirelessly to protect our ministry and those we serve,” said MBI
“We are confident that God remains sovereign over every circumstance, and we trust Him to grant wisdom and discernment as we navigate this situation together.”
MORE CONTEXT
-
Council of Europe hacked in ShinyHunters’ PeopleSoft heist
-
ShinyHunters claims more high-profile victims in latest Salesforce customers data heist
-
ShinyHunters hacked 100+ orgs by exploiting an Oracle PeopleSoft 0-day
-
Nottingham Uni says student records raided after ShinyHunters claims cyberattack
MBI has various operations, or “ministries.” Chief among them is its university, which offers undergraduate, graduate, and online courses for those pursuing ministry work. It also offers a
More than 250,000 students have studied at MBI since it was first established in 1886
It also runs Moody Radio, a Christian radio network/station, and a publishing arm devoted to Christian literature
ShinyHunters’ leak site lists 86 victims since January, although the number for the year is likely higher, since those who paid extortion fees would be removed from the list of breached organizations
The group has been linked to high-profile attacks involving Salesforce, Carnival, and Pitney Bowes
The gang has also claimed that a Oracle PeopleSoft campaign affected more than 100 organizations, and cited a PeopleSoft breach in the details about its attack on MBI
National security alerts were issued about ShinyHunters earlier in the year following its attack on learning platform Canvas, which compromised the data of an estimated 275 million students. ®
