Contact us Buy Me a Coffee

Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

moody.edu

moody.edu

Discovered 2026-06-15 19:28 UTC
Est. attack date 2026-06-15
Country US

Description:

Over 23 gigabytes of Moody Bible Institute data (1,300+ files, tens of millions of records) was compromised across enrollment, donor relations, payroll, and communications systems (MBI, EDC/Salesforce leads, PeopleSoft PS_COMMUNICATION, Horizon SIS, WHPD donor database, and Cadence admissions), including 46 million communication records, 2.2 million enrollment lead records, 108,000 biodemographic master files with addresses and birthdates, 3.3 gigabytes of donor gift data, employee payroll XML with home addresses and earnings, 1,100+ admissions outreach files, and student housing assignment records. This is a final warning to reach out by 18 June 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. | Updated: 16 June 2026 | Warning: FINAL WARNING PAY OR LEAK

Infostealer activity detected by HudsonRock

Compromised Employees: 18

Compromised Users: 128

Third Party Employee Credentials: 11


External Attack Surface: 82


DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • No emails found.
MX Records
  • moody-edu.mail.protection.outlook.com. Microsoft 365
TXT Records
  • ZOOM_verify_UfLqNnKsQU-sUGQY-wrOUQ
  • 00DHu00000Cwqa4=1TBQU00000008Tp
  • google-site-verification=to3WVFWRF9sCx2VKoFYinSJFQOWSOAQoPC9GFSFw89E
  • 00D5e000004ixSP=1TBUV00000005Kf
  • jamf-site-verification=43Rh-P_VEzT26nY8OfE6tg
  • stripe-verification=B1D7ED19631D2029C3D9D70EC15C80F024C9F6405C89E2CC0778DE2EC319C64D
  • apple-domain-verification=wmdvJDIuneWGTxK5
  • autodesk-domain-verification=Jjbro4C86utYQzT03_UY
  • v=spf1 ip4:66.185.255.157 ip4:69.38.189.130 ip4:172.23.4.0/24 include:spf.watermarkinsights.com include:_netblocks.eloqua.com include:_spf.act-on.net include:spf.protection.outlook.com ip4:12.228.6.215/32 include:ngwebsolutions.net -all
  • atlassian-domain-verification=frE4YMEGvOX0YMr+6uJrEYMrid5lODAOZeSap4L7ubUtNJuzskRUc1+D4LXWuT2k
Cloud / SaaS Services Detected
Apple Atlassian Stripe Autodesk JamF Zoom