My Well Ministry Data Breach — Class Action Review

My Well Ministry operates at the intersection of faith-based non-profit services, community outreach, and digital donation processing. Organizations of this nature typically provide financial, administrative, and technological infrastructure to religious and charitable entities, managing large volumes of recurring donations, membership directories, event registrations, and sensitive personal information. Because they facilitate digital giving and maintain extensive databases of donors, volunteers, and congregants, they routinely collect and store highly sensitive personal identifying information (PII) and financial records. This creates a deeply trusted repository of data that, if compromised, exposes individuals who simply sought to support charitable missions to severe privacy risks.

In 2025, My Well Ministry reported a significant security incident to the Indiana Attorney General, triggering legal scrutiny regarding the organization's cybersecurity infrastructure. While the exact vector of the breach remains under investigation, incidents affecting digital ministry and donation platforms frequently involve unauthorized access to cloud-hosted databases, compromised administrative credentials, or vulnerabilities within third-party payment processing integrations. Threat actors routinely target non-profit and faith-based technology providers under the assumption that their security budgets and continuous monitoring protocols may lag behind major commercial financial institutions, despite holding similarly lucrative financial and personal data.

The breach exposed a dangerous matrix of personal data, which likely includes full names, dates of birth, home addresses, email addresses, and sensitive financial account details or credit card information utilized for recurring donations. The exposure of financial account numbers and routing details creates an immediate and pressing danger of unauthorized transactions, ACH fraud, and financial account takeover. Furthermore, when PII such as names, birth dates, and contact information are paired with giving history, malicious actors can leverage this data to orchestrate highly targeted spear-phishing campaigns, identity theft, and fraudulent solicitations exploiting the victim's charitable inclinations.

As an entity handling sensitive financial transactions and personal records, My Well Ministry was bound by rigorous legal obligations under state data protection laws and the Federal Trade Commission Act to implement and maintain reasonable data security measures. These regulatory frameworks require organizations to deploy robust encryption, multi-factor authentication, regular vulnerability assessments, and strict access controls. The occurrence of a data breach of this magnitude strongly suggests potential failures in these foundational security duties, indicating that the ministry may have fallen short of the standard of care required to protect the private information entrusted to its care.

Receiving an official data breach notification letter from My Well Ministry is a formal acknowledgment that your private information was compromised due to inadequate security safeguards. Legally, this notification confirms your standing to participate in a class action lawsuit aimed at holding the organization accountable for failing to protect your data. You do not need to wait until you experience actual financial loss or identity theft to seek legal recourse; the increased risk of future harm alone is sufficient. Our law firm is actively investigating claims on behalf of affected individuals on a contingency fee basis, meaning there is never any out-of-pocket cost and we only collect a fee if we successfully recover compensation for you.