The Mormon Church has been hit by a major cyberattack

News
By published

Church claims host of sensitive data stolen

Red padlock open on electric circuits network dark red background
(Image credit: Shutterstock/Chor muang)

The Church of Jesus Christ of Latter-day Saints, often referred to as the LDS Church or Mormon Church, has suffered a data breach that involved sensitive personal information of Church members, employees, contractors, and friends. Payment and other banking data were not affected.

In an announcement , the Church said the data breach happened in late March 2022, but as the law enforcement investigation was ongoing, it was asked to keep the incident confidential. 

The Church did not name the threat actor behind the attack, nor did it say if any malware was used, but it did say that U.S. federal law enforcement authorities suspect the intrusion was “part of a pattern of state-sponsored cyberattacks aimed at organizations and governments around the world” that is not intended to cause harm to individuals.

Banking data safe

When the hackers managed to get into the Church’s database, they stole “basic” data, including usernames, membership record numbers, full names, gender information, email addresses, birthdates, postal addresses, phone numbers, and preferred language. 

While donation history, or banking information, was not affected, this is still enough sensitive data for identity theft, phishing, and other types of fraud. 

Read more

> Samsung confirms data breach, personal customer data stolen

> These are the top data breaches and cyber attacks of 2022

> These are the best firewalls right now

So far, the Church has not seen evidence of the data being used in the wild, but did urge everyone to be extra vigilant when receiving any emails, SMS messages, or phone calls, and to be on the lookout for potential fraud attempts. 

It also added that whoever was affected by the incident was already contacted, and those who had additional questions could reach out via phone numbers listed here.

To keep its members, employees, contractors, and friends secure, the Church employed external forensic experts, notified U.S. federal law enforcement, and “other cybersecurity professionals” that investigated the incident and “further enchanced” the security of Church systems. It did not detail what this enhancement means, nor did it provide affected individuals with identity protection services.

Sead Fadilpašić

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.