ShinyHunters claims data breach against moody.edu

• Ransomware group: ShinyHunters
• Country: United States
• Sector: Education
• Announcement date: June 15, 2026

ShinyHunters claims a massive data breach at Moody Bible Institute

The threat actor group known as ShinyHunters has announced a significant data breach targeting Moody Bible Institute. According to a claim posted on a leak site on June 15, 2026, the group alleges they have successfully compromised the institution's systems, resulting in the theft of approximately 23 GB of data. This claim follows a pattern of double extortion, a common ransomware tactic where attackers not only encrypt an organization's data but also threaten to leak sensitive information publicly to increase pressure during ransom negotiations.

The group has issued a deadline, stating that if a ransom is not paid by June 18, 2026, the stolen data will be released to the public. While the group has made these claims, no screenshot has been provided to verify the authenticity of the stolen data at this time.

Details of the alleged data theft

The ShinyHunters group claims that the stolen information was extracted from several critical institutional systems, including enrollment, donor relations, payroll, and communication platforms. The volume of the alleged theft is substantial, involving over 1,300 files. The group asserts that the compromised data includes a wide variety of sensitive records that could impact various stakeholders within the institution.

The specific types of data allegedly stolen include:

• Communication records
• Enrollment lead records
• Biodemographic data
• Donor data
• Employee payroll data
• Student housing records

The scope of the alleged leak is vast, with the group claiming to have obtained 46 million communication records and 2.2 million enrollment lead records. Furthermore, the claim includes 108,000 biodemographic files, 3.3 GB of donor gift data, and employee payroll XML files. The breach also reportedly involves over 1,100 admissions outreach files and various student housing records.

About Moody Bible Institute

Moody Bible Institute is a private Christian higher education institution based in Chicago. It offers undergraduate and graduate degree programs in fields such as biblical studies, theology, and missionary work.

Potential risks and organizational implications

This alleged breach poses significant risks to the privacy of the institution's students and employees. The exposure of biodemographic data and payroll information is particularly concerning, as such information can potentially lead to identity theft for the affected individuals. Because the institution is based in the United States, this incident may result in legal consequences under the Family Educational Rights and Privacy Act (FERPA) and various state-level data protection regulations.

Furthermore, the inclusion of donor and student data could trigger secondary risks, such as highly targeted phishing attacks. In such scenarios, attackers use the stolen personal information to craft convincing messages to deceive individuals into revealing further credentials or funds.

For organizations in the education sector, such incidents highlight the importance of robust cybersecurity frameworks. Defensive measures typically include implementing multi-factor authentication (MFA), maintaining strict access controls, and ensuring regular, encrypted backups are stored offline. Additionally, organizations often focus on continuous monitoring of their networks to detect unauthorized access early and implement data loss prevention (DLP) strategies to protect sensitive student and employee information.