The Episcopal Church, Domestic and Foreign Missionary Society Data Breach — Class Action Review

The Episcopal Church, Domestic and Foreign Missionary Society serves as the historic and administrative headquarters for one of the nation's prominent religious denominations, operating an extensive network of dioceses, parishes, schools, social service ministries, and global missionary operations. Because the organization functions simultaneously as a large-scale non-profit employer, a charitable administrator, and a community steward, it handles deep repositories of sensitive administrative, personnel, and financial data. The Society maintains comprehensive records concerning clergy members, lay employees, volunteers, donors, beneficiaries of its various outreach programs, and students enrolled in affiliated educational institutions. This vast operational footprint requires the centralized collection and retention of highly confidential personal identifying information across multiple generations of service.

In 2025, the organization reported a significant cybersecurity incident to the Maryland Attorney General, signaling a major breach of its digital infrastructure. While the exact vector remains under investigation, incidents affecting large multi-tiered non-profit institutions and religious organizations typically involve sophisticated network intrusions, unauthorized access to legacy databases, or vulnerabilities introduced through third-party administrative vendors. Non-profit organizations are frequently targeted by cybercriminals who recognize that sprawling, decentralized administrative structures and limited dedicated IT security budgets can create exploitable gaps in digital defenses, allowing unauthorized actors to dwell within networks undetected and exfiltrate sensitive files.

The exposure resulting from this incident compromises multiple categories of sensitive personal data, each carrying profound risks for the affected individuals. Because the organization manages extensive payroll, clergy benefits, and donor relations, the compromised files likely include full legal names, Social Security numbers, dates of birth, banking and direct deposit details, home addresses, tax withholding forms, and employment records. When Social Security numbers and banking details fall into the hands of malicious actors, victims face an immediate and sustained threat of identity theft, fraudulent credit card applications, unauthorized bank withdrawals, and fraudulent tax filings. Furthermore, the compromise of donor and beneficiary records exposes individuals to targeted phishing schemes and financial scams designed to exploit their philanthropic affiliations.

Under Maryland state law, including the Maryland Personal Information Protection Act (MPIPA), as well as foundational common law negligence principles, The Episcopal Church, Domestic and Foreign Missionary Society had a strict legal obligation to implement and maintain reasonable security procedures to safeguard private personal information from unauthorized access, destruction, modification, or disclosure. Organizations that collect and retain confidential data assume a duty of care to deploy robust administrative, physical, and technical safeguards, such as multi-factor authentication, network segmentation, and regular vulnerability assessments. The occurrence of a successful data exfiltration breach strongly indicates a failure in these required security protocols, raising serious questions regarding whether the organization adhered to industry-standard data protection benchmarks.

For individuals who received a formal data notification letter from The Episcopal Church, Domestic and Foreign Missionary Society, this correspondence serves as an official acknowledgment that their private information was compromised due to institutional security lapses. Legally, the receipt of this notice establishes standing to participate in a class action lawsuit aimed at holding the organization accountable for failing to protect sensitive data. Affected parties do not need to demonstrate actual financial loss or identity theft to seek legal recourse; the mere exposure of their personal information creates compensable legal harm under state and federal law. Our firm is actively investigating this breach and evaluates potential claims on a contingency fee basis, meaning class members pay nothing out of pocket unless a financial recovery is successfully secured on their behalf.