The Moody Bible Institute of Chicago Data Breach Notice (Oregon Attorney General)

The Moody Bible Institute of Chicago has notified 155,226 people that their personal information was exposed in an incident that occurred on June 12, 2026. The organisation filed the notice with the Oregon Department of Justice on July 31, 2026 — 49 days later.

What this exposure actually means for you

If you received a letter from the Moody Bible Institute, your personal information was among the records involved in this breach. The filing lists personal information as the category exposed. No passwords, no financial account numbers, and no government identifiers such as Social Security numbers appear in the disclosed categories.

That absence is important. Because no passwords were exposed, there is no need to change any login credentials for Moody Bible Institute accounts as a result of this incident. The risk centers on the personal information that was taken and what someone could do with it in the future.

The permanent nature of personal information

Personal information, once exposed, cannot be recalled or reissued. Unlike a credit card that can be cancelled and replaced, details such as your full name combined with date of birth, address history, or other biographical data stay with you for life. Criminals can use these details to attempt identity theft, file fraudulent tax returns, open accounts in your name, or impersonate you in correspondence.

The scale of this breach — more than 155,000 individuals — means the exposed data may circulate for years. Even if immediate fraud does not appear, the information retains value to identity thieves who combine it with data from other sources.

Why the 49-day gap matters

The incident took place on June 12, 2026. The organisation notified regulators and began sending letters 49 days later. State laws set different deadlines for breach notification, and this interval falls within many standard windows once an investigation has started. The filing does not disclose when the institute discovered the incident or what caused it.

What matters now is that the people whose records were included have been told. The Moody Bible Institute is required to notify affected Oregon residents directly, usually by mail to the last known address. If you have not received a letter, it is likely that your information was not part of this particular group of 155,226 records. However, if you have moved since June 12, 2026, or suspect your address on file may be outdated, contact the institute directly to confirm whether you were affected.

What you can still control

While you cannot erase the exposed personal information, you retain significant power over how it might be used against you. Monitoring remains the most practical defense. Early detection of suspicious activity lets you shut down fraud before it grows.

Place a fraud alert or credit freeze with the three major credit bureaus. A fraud alert requires lenders to verify your identity before opening new accounts. A freeze is stronger — it blocks new credit applications entirely until you lift it. Both are free and can be done in minutes online.

Review your credit reports every four months, rotating between Equifax, Experian, and TransUnion. Look for accounts or inquiries you do not recognize. Also monitor your bank and tax accounts for unexpected activity. The IRS and state tax agencies sometimes flag suspicious filings based on mismatched personal details.

Be cautious with any unsolicited contact that asks you to confirm personal information or claims to be from the Moody Bible Institute, a government agency, or a financial institution. Criminals who possess your exposed data may attempt phishing or vishing attacks that sound legitimate because they already know details about you.

The limits of what this filing tells us

The Oregon Attorney General’s record does not disclose the root cause of the breach, whether any internal systems were accessed, or the precise types of personal information belonging to each individual. It simply establishes that personal information for 155,226 people was exposed on June 12, 2026. Everything beyond those facts remains unknown to the public.

This means you should not assume the worst-case scenario, but you also cannot assume the best. Treat the exposed personal information as permanently sensitive and act accordingly. The absence of passwords and financial account numbers in the listed categories removes one major category of immediate risk, but it does not eliminate the long-term identity theft risk that comes with any large exposure of personal records.

The letter you may have received is the clearest indicator of whether your specific records were included. For anyone who has changed addresses since the June 12 incident date, reaching out to the Moody Bible Institute remains the only way to receive certainty. In the meantime, the practical steps above address the risks that actually exist based on what this filing discloses.