The Church of Jesus Christ of Latter-day Saints, often referred to as the LDS Church or Mormon Church, has suffered a data breach that involved sensitive personal information of Church members, employees, contractors, and friends. Payment and other banking data were not affected.
In an announcement (opens in new tab) , the Church said the data breach happened in late March 2022, but as the law enforcement investigation was ongoing, it was asked to keep the incident confidential.
The Church did not name the threat actor behind the attack, nor did it say if any malware (opens in new tab) was used, but it did say that U.S. federal law enforcement authorities suspect the intrusion was “part of a pattern of state-sponsored cyberattacks aimed at organizations and governments around the world” that is not intended to cause harm to individuals.
Banking data safe
When the hackers managed to get into the Church’s database, they stole “basic” data, including usernames, membership record numbers, full names, gender information, email addresses, birthdates, postal addresses, phone numbers, and preferred language.
While donation history, or banking information, was not affected, this is still enough sensitive data for identity theft, phishing, and other types of fraud.
So far, the Church has not seen evidence of the data being used in the wild, but did urge everyone to be extra vigilant when receiving any emails, SMS messages, or phone calls, and to be on the lookout for potential fraud attempts.
It also added that whoever was affected by the incident was already contacted, and those who had additional questions could reach out via phone numbers listed here (opens in new tab).
To keep its members, employees, contractors, and friends secure, the Church employed external forensic experts, notified U.S. federal law enforcement, and “other cybersecurity professionals” that investigated the incident and “further enchanced” the security of Church systems. It did not detail what this enhancement means, nor did it provide affected individuals with identity protection services.
