moody.edu Listed by shinyhunters Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On June 15, 2026, the threat actor known as shinyhunters listed moody.edu on its leak site, stating that more than 23 gigabytes of data from Moody Bible Institute had been taken. The listing described 1,300 files containing tens of millions of records drawn from enrollment, donor, payroll, and communications systems. The number of individuals affected remains unknown. The incident occurs against a backdrop of sustained targeting of educational and nonprofit institutions by ransomware and data-leak groups that seek both financial leverage and resale value from personal records.

Breaking down the breach

The only confirmed public information is the June 15, 2026 listing itself. No independent confirmation of the claimed volume or access method has been released by Moody Bible Institute or by investigators. The listing asserts that files were taken from named internal platforms, but the timing of the intrusion, the precise attack vector, and whether encryption or additional demands followed are not disclosed in available reporting.

Who is shinyhunters?

Shinyhunters is a well-documented threat actor that has appeared on data-breach forums and leak sites since at least 2020. The group has repeatedly claimed responsibility for intrusions at technology, retail, and education organizations, typically by publishing sample data and offering larger archives for sale or in exchange for payment. Its listings are presented as claims until corroborated by the affected organization or by law-enforcement statements.

Who is moody.edu?

Moody Bible Institute is a private evangelical Christian institution offering undergraduate, graduate, and distance-education programs. Organizations of this type maintain records on applicants, current and former students, donors, and employees. Such data sets commonly include contact details, academic histories, financial-aid information, and gift records, making them attractive to actors who monetize personal information.

The information in question

The shinyhunters listing claims exfiltration of internal files from multiple Moody Bible Institute systems. The reported summary enumerates specific record counts and file categories.

• 46 million communication records
• 2.2 million enrollment lead records
• 108,000 biodemographic master files containing addresses and birthdates
• 3.3 gigabytes of donor gift data
• Employee payroll XML files that include home addresses and earnings
• 1,100 admissions outreach files
• Student housing assignment records

Why it matters

Records that combine names, addresses, birthdates, and financial details can be used for identity-related fraud or targeted phishing. Donor and payroll information may also reveal relationships or compensation patterns that carry secondary privacy implications. For the institution, the incident adds to the operational burden of investigating scope, notifying affected parties where required, and reviewing access controls across the listed platforms.

What to do if you're exposed

Individuals who believe their information may be involved should monitor accounts for unusual activity and consider placing fraud alerts with credit bureaus. Changing passwords on any associated Moody Bible Institute portals and enabling multi-factor authentication where available are immediate steps. Readers can run a free exposure scan of their email address against known breach data to determine whether their details appear in published listings.

AICompiled with AI assistance from public sources and published under our editorial standards.