Church of the Nazarene Data Breach — Class Action Review

The Church of the Nazarene is a prominent international Protestant Christian denomination headquartered globally, with extensive administrative regional centers, educational institutions, publishing ministries, and local congregations operating across Indiana and throughout the United States. As a large-scale religious and non-profit organization, the church manages complex human resources, clergy payroll operations, donor databases, congregational member directories, benefit plan administration, and educational records. To facilitate these operations, employment, and charitable giving, the organization routinely collects, processes, and stores vast quantities of highly sensitive personally identifiable information belonging to clergy members, lay employees, volunteers, donors, and students.

In 2025, the Church of the Nazarene formally reported a significant data security incident to the Office of the Indiana Attorney General. While the full forensic scope continues to be evaluated, security incidents affecting large non-profit and religious institutions typically involve sophisticated cyberattacks such as unauthorized network intrusions, ransomware deployments, or third-party vendor compromises. These incidents often exploit vulnerabilities in digital infrastructure, allowing malicious actors to infiltrate internal servers containing confidential personnel files, administrative records, and financial management systems before detection.

The exposure resulting from this breach encompasses a dangerous amalgamation of private information, including full names, dates of birth, Social Security numbers, banking details, and compensation records. The compromise of Social Security numbers and financial data exposes victims to an elevated, long-term risk of identity theft, fraudulent tax filings, and unauthorized financial account takeovers. Furthermore, the leakage of employment and donor records compromises individual privacy, leaving affected personnel and congregants vulnerable to targeted phishing schemes, social engineering attacks, and secondary financial fraud that can persist for years after the initial incident.

Under Indiana state law and applicable federal privacy standards, organizations that collect and maintain sensitive personal information have an affirmative legal obligation to implement and maintain reasonable cybersecurity safeguards. The Indiana Security Breach Law, alongside general common law duties, mandates that entities handling private data utilize robust encryption, multi-factor authentication, network segmentation, and regular vulnerability assessments. The occurrence of a data breach of this magnitude strongly suggests potential failures in these foundational security protocols, raising serious questions regarding whether the organization fulfilled its legal duty of care to protect the confidential data entrusted to it.

Receiving a formal data breach notification letter from the Church of the Nazarene is a clear admission that your private information was compromised due to inadequate security measures. Legally, the receipt of this notice establishes the necessary standing to participate in a class action lawsuit aimed at holding the organization accountable for failing to safeguard your data. Plaintiffs in these actions do not need to prove that they have already suffered actual financial loss to seek legal remedy; the increased risk of future identity theft and the loss of privacy are legally cognizable harms. Our firm evaluates these cases on a strict contingency fee basis, meaning you pay nothing out of pocket and we only collect a fee if we successfully recover compensation on your behalf.